Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties [GHSA-mhm7-754m-9p8w]

[pjfanning]

Fix [GHSA-mhm7-754m-9p8w]: incomplete handling of @JsonView for EXTERNAL_PROPERTY case, for 3.x branch (3.1 and up).

2.x variant is #6054

[cowtowncoder]

Hmmh. Error message does seem misleading.

On the other hand, there is no information leakage shown.

[pjfanning]

@cowtowncoder I'm happy enough that this exception is valid here and what we probably need to get 2.18/2.21/2.22 to have the same result as this.

[cowtowncoder]

@cowtowncoder I'm happy enough that this exception is valid here and what we probably need to get 2.18/2.21/2.22 to have the same result as this.

Ok but what does it mean wrt what is wrong with JSON to bind? I am not sure I follow...

[pjfanning]

For me, with this POC, it is valid that in public view that a reader should fail to read input that has 'kind':'admin'.
The exception message is a bit confusing, I agree.

#6054 shows this same test scenario behaves differently in 2.18 and the read 'succeeds' exposing the admin values that the public view is not supposed to be able to see.

[cowtowncoder]

For me, with this POC, it is valid that in public view that a reader should fail to read input that has 'kind':'admin'.

Not necessarily, since:

The exception message is a bit confusing, I agree.

it really depends on why there should be failure. If unknown properties are allowed, then "secret" should just be ignored.

So I am not sure failure is to be expected.

Put another way: not leaking info means there's no proven security problem. There may be bug still.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.36%	📈 +0.000%
Branches	74.63%	📈 +0.030%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.36%	📈 +0.000%
Branches	74.63%	📈 +0.030%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.37%	📈 +0.010%
Branches	74.64%	📈 +0.040%

Coverage data generated from JaCoCo test results

[cowtowncoder]

Merged in:

• 3.1 (for 3.1.5)
• 3.2 (for 3.2.1)
• 3.x

EDIT: 3.1.5 and 3.2.1 now released.