Default addition of "org.springframework.integration.history" to trusted packages of DefaultKafkaHeaderMapper

[dsingh-harp]

Expected Behavior

By default, "org.springframework.integration.history" should be available to the trusted package of DefaultKafkaHeaderMapper.

Current Behavior

Message is not getting deserialized due to untrusted package(i.e "org.springframework.integration.history ")

Also raised a stack-overflow question i.e https://stackoverflow.com/questions/71305189/message-history-not-getting-deserialized

Context

What other alternatives have you considered?
Following are the alternatives that i considered
a) Defining a bean instance for DefaultKafkaHeaderMapper with the addTrustedPackages("*")
b) Defining a bean for "MessagingMessageConverter"
c) Setting "MessagingMessageConverter" with header mapper mentioned in a) for "ConcurrentKafkaListenerContainerFactory"

Are you aware of any workarounds?
No

[artembilan]

The JacksonJsonUtils adds this packages as trusted by default:

private static final List<String> TRUSTED_PACKAGES =
				Arrays.asList(
						"java.util",
						"java.lang",
						"org.springframework.messaging.support",
						"org.springframework.integration.support",
						"org.springframework.integration.message",
						"org.springframework.integration.store",
						"org.springframework.integration.history"
				);

So, it looks like a DefaultKafkaHeaderMapper used in the KafkaMessageDrivenChannelAdapter should be supplied with all those Spring Integration specific packages as well.

[dsingh-harp]

ok, I was using version 5.5.7 version. Not aware if things changed in later versions

[artembilan]

No, nothing changed. I just accepted your request and have plans for the next versions.
If we would have a fix, I would point to that one and close the issue.

For now stay tuned for the next release when the fix will be present!

[artembilan]

The SubscribableKafkaChannel uses IntegrationRecordMessageListener internally for creating messages from consumer record based on a default RecordMessagingMessageListenerAdapter strategy, which is just default MessagingMessageConverter with a default DefaultKafkaHeaderMapper.
We should apply the same trusted packages for that DefaultKafkaHeaderMapper over here as well.
And expose a setMessageConverter(MessageConverter messageConverter) like we do for KafkaMessageDrivenChannelAdapter.

[dsingh-harp]

Great! Thanks for considering it.

[pmahony893]

Changing Arrays.asList to List.of breaks this for Java 8, which is listed as a compatible version in the docs.

[garyrussell]

This is a known issue; fixed in the next release; you can fall back to 5.5.9 as a work around.

#3761 (comment)