eclipse-ee4j / eclipse-ee4j/jersey

Using SecurityEntityFilteringFeature with Jackson Databind results in "Cannot resolve PropertyFilter with id..." exceptions

Open
#4,130 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

Using Jersey's `SecurityEntityFilteringFeature` with Jackson Databind as specified in this [example project](https://github.com/jersey/jersey/blob/master/examples/entity-filtering-security/src/main/java/org/glassfish/jersey/examples/entityfiltering/security/SecurityEntityFilteringApplication.java#L69) results in this [error](https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/ser/std/StdSerializer.java#L370) due to the fact that ObjectMappers perviously created without FilterProviders are now misconfigured due to globally shared state.

This issue comes from the thread here: https://github.com/FasterXML/jackson-databind/issues/2293

From that thread you can see cowtowncoder's conclusion that
> overriding of findFilterId() leads to requirement of having filter provider for every serialization, anywhere -- this is what databind requires.

`findFilterId()` is overridden [here](https://github.com/eclipse-ee4j/jersey/blob/eafb9bdcb82dfa3fd76dd957d307b99d4a22c87f/media/json-jackson/src/main/java/org/glassfish/jersey/jackson/internal/FilteringJacksonJaxbJsonProvider.java#L72).

Here is an example project which replicates this issue: https://github.com/postsa/JacksonJerseyBugExample

If you call the model1 endpoint before the model2 endpoint in the above project, the model1 call filters the sensitive field but the model2 endpoint throws

> 'Cannot resolve PropertyFilter with id 'com.spost.jjbug.ResponseModel'; no FilterProvider configured'.

If you call them in the opposite order you don't see the exception but you also don't get any of the filtering.

Contributor guide

Open the contributing guide

Research direction

Start with FilteringJacksonJaxbJsonProvider.java and the SecurityEntityFilteringApplication.java example, then reproduce the behavior in JacksonJerseyBugExample by calling model1 and model2 in both orders. Done means both endpoints consistently filter the sensitive field without raising the missing FilterProvider exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.