@JsonView by-passed for some "setterless" creator properties [CVE-2026-54517] - #5969

…roperties (#5970)

Honor the active @JSONVIEW in every property-based-creator buffering path,
not just the originally-patched ones (sibling of #5969/#5971):

- BuilderBasedDeserializer._deserializeUsingPropertyBased (regular-property branch)
- BuilderBasedDeserializer.deserializeUsingPropertyBasedWithUnwrapped (creator + regular)
- BeanDeserializer.deserializeUsingPropertyBasedWithUnwrapped (creator + regular)
- BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId (creator + regular)
- BeanDeserializer._deserializeRecordForUpdate (creator)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

#6004)

Honor the active @JSONVIEW in every property-based-creator buffering path,
not just the originally-patched ones from #5969/#5971

### What changes were proposed in this pull request?

This PR upgrades `FasterXML` `Jackson` to 2.21.4.

### Why are the changes needed?

- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.4 (2026-05-28)
  - FasterXML/jackson-core#1611
  - FasterXML/jackson-databind#5931
  - FasterXML/jackson-databind#5950
  - FasterXML/jackson-databind#5951
  - FasterXML/jackson-databind#5967
  - FasterXML/jackson-databind#5969
  - FasterXML/jackson-databind#5971
  - FasterXML/jackson-databind#5974
  - FasterXML/jackson-databind#5981
  - FasterXML/jackson-databind#5988
  - FasterXML/jackson-databind#5993

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Pass the CIs.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 4.8)

Closes #56338 from dongjoon-hyun/SPARK-57273.

Authored-by: Dongjoon Hyun <dongjoon@apache.org>
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>

### What changes were proposed in this pull request?

This PR upgrades `FasterXML` `Jackson` to 2.21.4.

### Why are the changes needed?

- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.4 (2026-05-28)
  - FasterXML/jackson-core#1611
  - FasterXML/jackson-databind#5931
  - FasterXML/jackson-databind#5950
  - FasterXML/jackson-databind#5951
  - FasterXML/jackson-databind#5967
  - FasterXML/jackson-databind#5969
  - FasterXML/jackson-databind#5971
  - FasterXML/jackson-databind#5974
  - FasterXML/jackson-databind#5981
  - FasterXML/jackson-databind#5988
  - FasterXML/jackson-databind#5993

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Pass the CIs.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 4.8)

Closes apache#56338 from dongjoon-hyun/SPARK-57273.

Authored-by: Dongjoon Hyun <dongjoon@apache.org>
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
(cherry picked from commit 0536814)

### What changes were proposed in this pull request?

This PR upgrades `FasterXML` `Jackson` to 2.21.4.

### Why are the changes needed?

- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.4 (2026-05-28)
  - FasterXML/jackson-core#1611
  - FasterXML/jackson-databind#5931
  - FasterXML/jackson-databind#5950
  - FasterXML/jackson-databind#5951
  - FasterXML/jackson-databind#5967
  - FasterXML/jackson-databind#5969
  - FasterXML/jackson-databind#5971
  - FasterXML/jackson-databind#5974
  - FasterXML/jackson-databind#5981
  - FasterXML/jackson-databind#5988
  - FasterXML/jackson-databind#5993

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Pass the CIs.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 4.8)

Closes apache#56338 from dongjoon-hyun/SPARK-57273.

Authored-by: Dongjoon Hyun <dongjoon@apache.org>
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
(cherry picked from commit 0536814)

…g creator collection at 2.15.4

Port of the [databind#5969] hunks of upstream c76ae1a
("Backport FasterXML#5969 and FasterXML#5971 fixes into 2.18", FasterXML#6003) by Tatu Saloranta,
shipped in 2.18.8, onto the 2.15.4 baseline (GHSA-5hh8-q8hv-fr38).

While collecting creator properties, BeanDeserializer and
BuilderBasedDeserializer buffered regular (non-creator) properties with
no active-view check, so a property restricted by @JSONVIEW was written
from JSON under a view that excludes it. The four [databind#5969] hunks
add the check in _deserializeUsingPropertyBased and
deserializeUsingPropertyBasedWithUnwrapped of both classes; the
activeView local of the unwrapped methods comes with them. The
[databind#5971] hunks of the same upstream commit are the
CVE-2026-54518 commit. Production lines equal upstream's; release notes
not ported.

Tests: upstream's BuilderViewBypass5969And5971Test, unchanged except
that it no longer extends DatabindTestUtil (absent at 2.15.4) and takes
newJsonMapper()/a2q() by static import, the way 2.15.4's own JUnit 5
tests do. It covers the non-unwrapped paths only, so
BufferedPropsViewWithUnwrapped5969Test (written by us, plain unit test)
covers the two unwrapped-path hunks for a bean and a builder.

Upstream-Commit: c76ae1a
Co-authored-by: Tatu Saloranta <tatu.saloranta@iki.fi>

…unwrapped properties at 2.15.4

Port of the [databind#5971] hunks of upstream c76ae1a
("Backport FasterXML#5969 and FasterXML#5971 fixes into 2.18", FasterXML#6003) by Tatu Saloranta,
shipped in 2.18.8, onto the 2.15.4 baseline (GHSA-rcqc-6cw3-h962).

deserializeUsingPropertyBasedWithUnwrapped() in BeanDeserializer and
BuilderBasedDeserializer assigned creator properties with no
active-view check (the plain property-based path has one), so a
@JsonView-restricted creator parameter of a POJO that also has a
@JsonUnwrapped property was set from JSON under a view that excludes it.
2.15.4 has no unwrapped creator parameters (rejected as "not yet
supported"), so the 2.19+ UnwrappedPropertyHandler sink of upstream
721fa07 does not exist here; the 2.18 backport's hunks are the whole
fix. Production lines equal upstream's; together with the
CVE-2026-54517 commit they are all of c76ae1a's production lines.
Release notes not ported.

Test: upstream's 2.18 test has no case for these hunks, so
CreatorPropsViewWithUnwrapped5971Test (written by us, plain unit test)
checks a bean and a builder with a view-restricted creator parameter
and an unwrapped property, plus the already-gated plain case.

Upstream-Commit: c76ae1a
Co-authored-by: Tatu Saloranta <tatu.saloranta@iki.fi>

…@JsonUnwrapped at 2.19.4

Port of the FasterXML#5971 hunks of upstream c76ae1a
("Backport FasterXML#5969 and FasterXML#5971 fixes into 2.18 (FasterXML#6003)", Tatu Saloranta),
shipped in 2.18.8 and merged forward into upstream's 2.19 branch, plus
the UnwrappedPropertyHandler hunk of
721fa07 ("Backport FasterXML#5971: `@JsonView`
by-passed for unwrapped creator parameters (FasterXML#5973)", Tatu Saloranta),
shipped in 2.21.4, onto the 2.19.4 baseline.

With a @JsonUnwrapped property present, BeanDeserializer and
BuilderBasedDeserializer.deserializeUsingPropertyBasedWithUnwrapped()
assigned every named creator property without checking the active
view, and UnwrappedPropertyHandler.processUnwrappedCreatorProperties()
(2.19's support for @JsonUnwrapped creator parameters) replayed the
buffered input into every unwrapped creator parameter the same way. A
@JSONVIEW(Admin) creator parameter was therefore written from JSON read
under a narrower view. Both paths now skip creator properties that are
not visible in the active view, as _deserializeUsingPropertyBased()
already did.

The two deserializer hunks are c76ae1a's creator-property hunks;
c76ae1a's regular-property hunks belong to CVE-2026-54517 and are a
separate commit. Upstream's 2.19 branch never received 721fa07 (its
2.18 base has no processUnwrappedCreatorProperties), so that hunk comes
from 2.21; its context is identical at 2.19.4. Release-notes hunks are
not ported.

Sinks: the three places that assign creator parameters from input
while @JsonUnwrapped is in play (the two deserializeUsingPropertyBased-
WithUnwrapped loops and processUnwrappedCreatorProperties).

Binary compatibility: no signature changes.

Regression tests: upstream's UnwrappedCreatorViewBypass5971Test from
721fa07, unchanged; upstream has no test for the two deserializer
hunks, so CreatorViewWithUnwrappedTest (bean and builder) is written by
us.

Upstream-Commit: c76ae1a
Upstream-Commit: 721fa07
Co-authored-by: Tatu Saloranta <tatu.saloranta@iki.fi>

…the creator runs at 2.19.4

Port of the FasterXML#5969 hunks of upstream c76ae1a
("Backport FasterXML#5969 and FasterXML#5971 fixes into 2.18 (FasterXML#6003)", Tatu Saloranta),
shipped in 2.18.8 and merged forward into upstream's 2.19 branch, onto
the 2.19.4 baseline.

While collecting property-based creator arguments, BeanDeserializer
(_deserializeUsingPropertyBased(), deserializeUsingPropertyBased-
WithUnwrapped()) and BuilderBasedDeserializer (the same two loops)
buffered every regular property they met without checking the active
view, and assigned the buffered values once the creator ran. A
@JSONVIEW(Admin) setter or builder method placed between creator
properties in the input was therefore written under a narrower view.
The four loops now skip properties not visible in the active view.

With the CVE-2026-54518 commit before it, BeanDeserializer.java and
BuilderBasedDeserializer.java now equal upstream's origin/2.19; the
test file is upstream's, unchanged. Release-notes hunks not ported.

Sinks: these four loops are the only places regular properties are
buffered during creator-argument collection (deserializeWithView()
already checks views for the non-creator path).

Binary compatibility: no signature changes.

Regression test: upstream's BuilderViewBypass5969And5971Test, unchanged.

Upstream-Commit: c76ae1a
Co-authored-by: Tatu Saloranta <tatu.saloranta@iki.fi>