Upgrade to Jackson 2.10

* Remove extraneous code

* Realign white listing with similar implementation in Spring Security: fhanik/spring-security@c0b4833

* 2.10 GA

Author: garyrussell

build.gradle

@@ -63,7 +63,7 @@ ext {
 	hibernateVersion = '5.4.5.Final'
 	hsqldbVersion = '2.5.0'
 	h2Version = '1.4.199'
-	jacksonVersion = '2.9.9.20190807'
+	jacksonVersion = '2.10.0'
 	javaxActivationVersion = '1.2.0'
 	javaxMailVersion = '1.6.2'
 	jmsApiVersion = '2.0.1'

spring-integration-core/src/main/java/org/springframework/integration/json/JsonPropertyAccessor.java

@@ -16,7 +16,6 @@
 
 package org.springframework.integration.json;
 
-import java.io.IOException;
 import java.util.AbstractList;
 import java.util.Iterator;
 
@@ -113,9 +112,6 @@ else if (target instanceof String) {
 			catch (JsonProcessingException e) {
 				throw new AccessException("Exception while trying to deserialize String", e);
 			}
-			catch (IOException e) {
-				throw new AccessException("Exception while trying to deserialize String", e);
-			}
 		}
 		else {
 			throw new IllegalStateException("Can't happen. Check SUPPORTED_CLASSES");

spring-integration-core/src/main/java/org/springframework/integration/support/json/Jackson2JsonObjectMapper.java

@@ -40,6 +40,7 @@
 import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.Module;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 
 /**
  * Jackson 2 JSON-processor (@link https://github.com/FasterXML)
@@ -70,9 +71,10 @@ public class Jackson2JsonObjectMapper extends AbstractJacksonJsonObjectMapper<Js
 	private final ObjectMapper objectMapper;
 
 	public Jackson2JsonObjectMapper() {
-		this.objectMapper = new ObjectMapper();
-		this.objectMapper.configure(MapperFeature.DEFAULT_VIEW_INCLUSION, false);
-		this.objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+		this.objectMapper = JsonMapper.builder()
+				.configure(MapperFeature.DEFAULT_VIEW_INCLUSION, false)
+				.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+				.build();
 		registerWellKnownModulesIfAvailable();
 	}
 

spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java

@@ -34,7 +34,9 @@
 import com.fasterxml.jackson.databind.JavaType;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
 import com.fasterxml.jackson.databind.jsontype.NamedType;
+import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
 import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
 import com.fasterxml.jackson.databind.module.SimpleModule;
 
@@ -101,6 +103,8 @@ public static ObjectMapper messagingAwareMapper(String... trustedPackages) {
 	 *
 	 * @author Rob Winch
 	 * @author Artem Bilan
+	 * @author Filip Hanik
+	 * @author Gary Russell
 	 *
 	 * @since 4.3.11
 	 */
@@ -111,7 +115,12 @@ private static final class WhitelistTypeResolverBuilder extends ObjectMapper.Def
 		private final String[] trustedPackages;
 
 		WhitelistTypeResolverBuilder(String... trustedPackages) {
-			super(ObjectMapper.DefaultTyping.NON_FINAL);
+			super(ObjectMapper.DefaultTyping.NON_FINAL,
+					//we do explicit validation in the TypeIdResolver
+					BasicPolymorphicTypeValidator.builder()
+							.allowIfSubType(Object.class)
+							.build());
+
 			this.trustedPackages =
 					trustedPackages != null ? Arrays.copyOf(trustedPackages, trustedPackages.length) : null;
 
@@ -120,10 +129,12 @@ private static final class WhitelistTypeResolverBuilder extends ObjectMapper.Def
 		}
 
 		@Override
-		protected TypeIdResolver idResolver(MapperConfig<?> config, JavaType baseType, Collection<NamedType> subtypes,
-				boolean forSer, boolean forDeser) {
-			TypeIdResolver delegate = super.idResolver(config, baseType, subtypes, forSer, forDeser);
-			return new WhitelistTypeIdResolver(delegate, this.trustedPackages);
+		protected TypeIdResolver idResolver(MapperConfig<?> config,
+				JavaType baseType,
+				PolymorphicTypeValidator subtypeValidator,
+				Collection<NamedType> subtypes, boolean forSer, boolean forDeser) {
+			TypeIdResolver result = super.idResolver(config, baseType, subtypeValidator, subtypes, forSer, forDeser);
+			return new WhitelistTypeIdResolver(result, this.trustedPackages);
 		}
 
 	}

spring-integration-core/src/main/java/org/springframework/integration/support/json/MessageJacksonDeserializer.java

@@ -24,7 +24,6 @@
 import org.springframework.messaging.Message;
 import org.springframework.util.Assert;
 
-import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.databind.DeserializationContext;
 import com.fasterxml.jackson.databind.JavaType;
 import com.fasterxml.jackson.databind.JsonNode;
@@ -49,7 +48,6 @@ public abstract class MessageJacksonDeserializer<T extends Message<?>> extends S
 
 	protected MessageJacksonDeserializer(Class<T> targetType) {
 		super(targetType);
-		this.mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
 	}
 
 	public void setMapper(ObjectMapper mapper) {

spring-integration-core/src/test/java/org/springframework/integration/json/ObjectToJsonTransformerTests.java

@@ -33,8 +33,9 @@
 import org.springframework.messaging.MessageHeaders;
 import org.springframework.messaging.support.GenericMessage;
 
-import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.json.JsonWriteFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.fasterxml.jackson.databind.node.TextNode;
 
@@ -146,8 +147,9 @@ public void objectPayload() {
 
 	@Test
 	public void objectPayloadWithCustomObjectMapper() {
-		ObjectMapper customMapper = new ObjectMapper();
-		customMapper.configure(JsonGenerator.Feature.QUOTE_FIELD_NAMES, Boolean.FALSE);
+		ObjectMapper customMapper = JsonMapper.builder()
+				.configure(JsonWriteFeature.QUOTE_FIELD_NAMES, false)
+				.build();
 		ObjectToJsonTransformer transformer = new ObjectToJsonTransformer(new Jackson2JsonObjectMapper(customMapper));
 		TestPerson person = new TestPerson("John", "Doe", 42);
 		person.setAddress(new TestAddress(123, "Main Street"));

spring-integration-mqtt/src/test/java/org/springframework/integration/mqtt/BackToBackAdapterTests.java

@@ -106,6 +106,15 @@ public void testSingleTopic() {
 
 	@Test
 	public void testJson() {
+		testJsonCommon("org.springframework");
+	}
+
+	@Test
+	public void testJsonNoTrust() {
+		testJsonCommon();
+	}
+
+	private void testJsonCommon(String... trusted) {
 		MqttPahoMessageHandler adapter = new MqttPahoMessageHandler("tcp://localhost:1883", "si-test-out");
 		adapter.setDefaultTopic("mqtt-foo");
 		adapter.setBeanFactory(mock(BeanFactory.class));
@@ -132,7 +141,12 @@ public void testJson() {
 		assertThat(out).isNotNull();
 		adapter.stop();
 		inbound.stop();
-		assertThat(out.getPayload()).isEqualTo(new Foo("bar"));
+		if (trusted != null) {
+			assertThat(out.getPayload()).isEqualTo(new Foo("bar"));
+		}
+		else {
+			assertThat(out.getPayload()).isNotEqualTo(new Foo("bar"));
+		}
 		assertThat(out.getHeaders().get(MqttHeaders.RECEIVED_TOPIC)).isEqualTo("mqtt-foo");
 		assertThat(out.getHeaders().get("baz")).isEqualTo("qux");
 	}