WW-5748 fix(rest): let Jackson XML's deserializer modifier see the bean deserializer

[lukaszlenart]

Fixes WW-5748

Problem

JacksonXmlHandler registered ParameterAuthorizingModule on an XmlMapper whose constructor had already registered JacksonXmlModule. A module's deserializer modifier is inserted at the head of the list, so the authorizing modifier ran first and handed Jackson XML's modifier a RedactionAwareDeserializer, which fails its instanceof BeanDeserializerBase test. The XML wrapper that reads an unwrapped list (@JacksonXmlElementWrapper(useWrapping = false)) was never installed, and every such list failed to deserialize through the XML handler — authorization context or not — since the module was introduced in 7.2.0.

Change

• The handler builds the XmlMapper without a module and registers JacksonXmlModule after ParameterAuthorizingModule, so the XML modifier runs first and the authorizing wrapper goes around its result. Same XmlFactory defaults (external entities and DTD support off) as the default constructor. The module's Javadoc states the order for handlers that register it themselves.
• With Jackson XML's wrapper now inside the authorizing one, the per-property @JsonIdentityInfo reader rebuild in RedactionAwareDeserializer.createContextual (WW-5746) walks delegating wrappers down to the bean. Jackson XML's wrapper cannot take a new delegatee, so it is rebuilt around the bean and contextualized with a null property, which recomputes its unwrapped names without building the id reader over again. The wrapper only stays around a bean that has an unwrapped list, so the test bean carries both.
• jackson-dataformat-xml is optional for the plugin: the class naming its wrapper (XmlWrapperSupport.Xml) is loaded only once Class.forName has confirmed it is present; the JSON path never reaches it.

Tests

JacksonXmlHandlerTest (existing class, extended): unwrapped list without a context, authorized, rejected; @JacksonXmlText with an element sibling; sole text with an attribute (Jackson XML's text deserializer, also newly reachable) read and authorized; per-property bean-typed @JsonIdentityInfo on a bean with an unwrapped list, authorized under child.id.k. The two XML any-setter tests in ParameterAuthorizingModuleTest now build their mapper the way the handler does.

mvn test -DskipAssembly -pl plugins/rest: 216 tests, 0 failures. One code-review pass and one security pass (module order vs. property wrapping, XML renames, resync under virtual wrapping, the null-property re-contextualization, the optional-dependency guard under a class loader without the XML jar, XmlFactory defaults): nothing newly introduced.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud