Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Code clean up for JacksonJsonUtils

Browse Source 
* Mention `trustedPackages` in the `redis.adoc`

**Cherry-pick to 5.3.x, 5.2.x, 5.1.x & 4.3.x**
This commit is contained in:
artembilan
2020-06-09 14:30:15 -04:00
committed by Gary Russell
parent 7ff0fdd022
commit 415fb6465f
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2017 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -177,13 +177,13 @@ public final class JacksonJsonUtils {
WhitelistTypeIdResolver(TypeIdResolver delegate, String... trustedPackages) {
this.delegate = delegate;
if (trustedPackages != null) {
for (String whiteListClass : trustedPackages) {
if ("*".equals(whiteListClass)) {
for (String whiteListPackage : trustedPackages) {
if ("*".equals(whiteListPackage)) {
this.trustedPackages.clear();
break;
}
else {
this.trustedPackages.add(whiteListClass);
this.trustedPackages.add(whiteListPackage);
}
}
}
@@ -234,7 +234,10 @@ public final class JacksonJsonUtils {
private boolean isTrustedPackage(String packageName) {
if (!this.trustedPackages.isEmpty()) {
for (String trustedPackage : this.trustedPackages) {
if (packageName.equals(trustedPackage) || packageName.startsWith(trustedPackage + ".")) {
if (packageName.equals(trustedPackage) ||
(!packageName.equals("java.util.logging")
&& packageName.startsWith(trustedPackage + "."))) {
return true;
}
}

2
src/reference/asciidoc/redis.adoc
View File

@@ -344,6 +344,8 @@ They have to be configured via the `SimpleModule` options for the `ObjectMapper`
In addition, `enableDefaultTyping` should be configured on the `ObjectMapper` to add type information for each serialized complex object.
That type information is then used during deserialization.
The Framework provides a utility method `JacksonJsonUtils.messagingAwareMapper()`, which is already supplied with all the above-mentioned properties and serializers.
This utility method comes with the `trustedPackages` argument to limit Java packages for deserialization to avoid security vulnerabilities.
The default trusted packages: `java.util`, `java.lang`, `org.springframework.messaging.support`, `org.springframework.integration.support`, `org.springframework.integration.message`, `org.springframework.integration.store`.
To manage JSON serialization in the `RedisMessageStore`, it must be configured like so:
[source,java]