From 415fb6465f7cc4f0f0fdac3d8a7865efd7e03da1 Mon Sep 17 00:00:00 2001
From: artembilan <raven666>
Date: Tue, 9 Jun 2020 14:30:15 -0400
Subject: [PATCH] Code clean up for `JacksonJsonUtils`

* Mention `trustedPackages` in the `redis.adoc`

**Cherry-pick to 5.3.x, 5.2.x, 5.1.x & 4.3.x**
---
 .../integration/support/json/JacksonJsonUtils.java  | 13 ++++++++-----
 src/reference/asciidoc/redis.adoc                   |  2 ++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java b/spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java
index 5e2b7a7349..85a0ea7bae 100644
--- a/spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java
+++ b/spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2020 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -177,13 +177,13 @@ public final class JacksonJsonUtils {
 		WhitelistTypeIdResolver(TypeIdResolver delegate, String... trustedPackages) {
 			this.delegate = delegate;
 			if (trustedPackages != null) {
-				for (String whiteListClass : trustedPackages) {
-					if ("*".equals(whiteListClass)) {
+				for (String whiteListPackage : trustedPackages) {
+					if ("*".equals(whiteListPackage)) {
 						this.trustedPackages.clear();
 						break;
 					}
 					else {
-						this.trustedPackages.add(whiteListClass);
+						this.trustedPackages.add(whiteListPackage);
 					}
 				}
 			}
@@ -234,7 +234,10 @@ public final class JacksonJsonUtils {
 		private boolean isTrustedPackage(String packageName) {
 			if (!this.trustedPackages.isEmpty()) {
 				for (String trustedPackage : this.trustedPackages) {
-					if (packageName.equals(trustedPackage) || packageName.startsWith(trustedPackage + ".")) {
+					if (packageName.equals(trustedPackage) ||
+							(!packageName.equals("java.util.logging")
+									&& packageName.startsWith(trustedPackage + "."))) {
+
 						return true;
 					}
 				}
diff --git a/src/reference/asciidoc/redis.adoc b/src/reference/asciidoc/redis.adoc
index f1a2005dfe..73b4ab9cda 100644
--- a/src/reference/asciidoc/redis.adoc
+++ b/src/reference/asciidoc/redis.adoc
@@ -344,6 +344,8 @@ They have to be configured via the `SimpleModule` options for the `ObjectMapper`
 In addition, `enableDefaultTyping` should be configured on the `ObjectMapper` to add type information for each serialized complex object.
 That type information is then used during deserialization.
 The Framework provides a utility method `JacksonJsonUtils.messagingAwareMapper()`, which is already supplied with all the above-mentioned properties and serializers.
+This utility method comes with the `trustedPackages` argument to limit Java packages for deserialization to avoid security vulnerabilities.
+The default trusted packages: `java.util`, `java.lang`, `org.springframework.messaging.support`, `org.springframework.integration.support`, `org.springframework.integration.message`, `org.springframework.integration.store`.
 To manage JSON serialization in the `RedisMessageStore`, it must be configured like so:
 
 [source,java]