Spring vault invalid jackson compat logic

[RouxAntoine]

Hi,

Not sure but is it normal that in this code

https://github.com/spring-projects/spring-vault/blob/main/spring-vault-core/src/main/java/org/springframework/vault/support/JacksonCompat.java#L74-L89

both jackson2JsonNode and jackson3JsonNode use the Jackson2 classloader ?

I could produce a quick fix if this is not the intended behaviour.

Regards,

[RouxAntoine]

I think that this line

			jackson3JsonNode = ClassUtils.isPresent("tools.jackson.databind.JsonNode", Jackson2.class.getClassLoader())
					? ClassUtils.forName("tools.jackson.databind.JsonNode", Jackson2.class.getClassLoader())
					: null;

should be

			jackson3JsonNode = ClassUtils.isPresent("tools.jackson.databind.JsonNode", Jackson3.class.getClassLoader())
					? ClassUtils.forName("tools.jackson.databind.JsonNode", Jackson3.class.getClassLoader())
					: null;

[mp911de]

Actually, we should use the parent class to obtain the class loader from to avoid unwanted access to jackson types.

[RouxAntoine]

Hi @mp911de thanks for answer, something like this.class.getClassloader() ?
or maybe JacksonCompat.class.getClassLoader()

[RouxAntoine]

Here is the pull request proposed to fix this #987

But I am curious what happen if we try to use spring-vault 4.0.1 with spring boot 3.x.x application

[RouxAntoine]

I am a little bit lost regarding this debugging