Blame SOURCES/CVE-2017-17485-2.patch

f79a0c
From bb45fb16709018842f858f1a6e1118676aaa34bd Mon Sep 17 00:00:00 2001
f79a0c
From: Tatu Saloranta <tatu.saloranta@iki.fi>
f79a0c
Date: Tue, 19 Dec 2017 08:31:15 -0800
f79a0c
Subject: [PATCH] Fix issues with earlier fix for #1855
f79a0c
f79a0c
---
f79a0c
 .../jackson/databind/jsontype/impl/SubTypeValidator.java         | 5 +++--
f79a0c
 .../jackson/databind/interop/IllegalTypesCheckTest.java          | 7 +++++++
f79a0c
 .../springframework/jacksontest/AbstractApplicationContext.java  | 5 +++++
f79a0c
 .../org/springframework/jacksontest/AbstractPointcutAdvisor.java | 5 +++++
f79a0c
 .../org/springframework/jacksontest/BogusApplicationContext.java | 9 +++++++++
f79a0c
 .../org/springframework/jacksontest/BogusPointcutAdvisor.java    | 9 +++++++++
f79a0c
 6 files changed, 38 insertions(+), 2 deletions(-)
f79a0c
 create mode 100644 src/test/java/org/springframework/jacksontest/AbstractApplicationContext.java
f79a0c
 create mode 100644 src/test/java/org/springframework/jacksontest/AbstractPointcutAdvisor.java
f79a0c
 create mode 100644 src/test/java/org/springframework/jacksontest/BogusApplicationContext.java
f79a0c
 create mode 100644 src/test/java/org/springframework/jacksontest/BogusPointcutAdvisor.java
f79a0c
f79a0c
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
f79a0c
index 8a273cc15..45a76169f 100644
f79a0c
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
f79a0c
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
f79a0c
@@ -71,6 +71,7 @@ public void validateSubType(DeserializationContext ctxt, JavaType type) throws J
f79a0c
         final Class raw = type.getRawClass();
f79a0c
         String full = raw.getName();
f79a0c
 
f79a0c
+        main_check:
f79a0c
         do {
f79a0c
             if (_cfgIllegalClassNames.contains(full)) {
f79a0c
                 break;
f79a0c
@@ -84,8 +85,8 @@ public void validateSubType(DeserializationContext ctxt, JavaType type) throws J
f79a0c
                     // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
f79a0c
                     if ("AbstractPointcutAdvisor".equals(name)
f79a0c
                             // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
f79a0c
-                            || "AbstractApplicationContext.equals".equals(name)) {
f79a0c
-                        break;
f79a0c
+                            || "AbstractApplicationContext".equals(name)) {
f79a0c
+                        break main_check;
f79a0c
                     }
f79a0c
                 }
f79a0c
             }