Fix #5354: do not write cglibs Callback[] getCallbacks() (3.x) (#5357)

Author: rwinch

release-notes/CREDITS

@@ -87,3 +87,8 @@ Dónal Murtagh (@donalmurtagh)
 Phil Clay (@philsttr)
  * Reported #5344: "Unexpected end-of-input" for `JsonParser.readValueAs()` (in 3.0)
   [3.0.1]
+
+Rob Winch (@rwinch)
+ * Reported, contributed fix for #5354: jackson-databind 3.0.0 renders `callbacks`
+   property from Spring CGLIB Proxy
+  [3.0.1]

release-notes/VERSION

@@ -16,6 +16,8 @@ Versions: 3.x (for earlier see VERSION-2.x)
  (reported by @Artur)
 #5344: "Unexpected end-of-input" for `JsonParser.readValueAs()` (in 3.0)
  (reported by Phil C)
+#5354: jackson-databind 3.0.0 renders `callbacks` property from Spring CGLIB Proxy
+ (reported, fix contributed by Rob W)
 
 3.0.0 (03-Oct-2025)
 

src/main/java/tools/jackson/databind/introspect/DefaultAccessorNamingStrategy.java

@@ -110,14 +110,12 @@ public String findNameForRegularGetter(AnnotatedMethod am, String name)
             // coverage without false matches; but for now let's assume there is
             // no reason to use any such getter from CGLib.
 
-            // 05-Oct-2020, tatu: Removed from Jackson 3.0
-            /*
+            // 20-Oct-2025 https://github.com/FasterXML/jackson-databind/issues/5354
             if ("getCallbacks".equals(name)) {
                 if (_isCglibGetCallbacks(am)) {
                     return null;
                 }
-            } else */
-            if ("getMetaClass".equals(name)) {
+            } else if ("getMetaClass".equals(name)) {
                 // 30-Apr-2009, tatu: Need to suppress serialization of a cyclic reference
                 if (_isGroovyMetaClassGetter(am)) {
                     return null;
@@ -198,8 +196,7 @@ protected String stdManglePropertyName(final String basename, final int offset)
     // name "getCallbacks" and we need to determine if it is indeed injected
     // by Cglib. We do this by verifying that the  result type is "net.sf.cglib.proxy.Callback[]"
 
-    // 05-Oct-2020, tatu: Removed from 3.0
-    /*
+    // 20-Oct-2025 https://github.com/FasterXML/jackson-databind/issues/5354
     protected boolean _isCglibGetCallbacks(AnnotatedMethod am)
     {
         Class<?> rt = am.getRawType();
@@ -222,7 +219,6 @@ protected boolean _isCglibGetCallbacks(AnnotatedMethod am)
         }
         return false;
     }
-    */
 
     // 05-Oct-2020, tatu: Left in 3.0 for now
     // Another helper method to deal with Groovy's problematic metadata accessors

src/test/java/tools/jackson/databind/ext/cglib/CglibFiltering5354Test.java

@@ -24,17 +24,14 @@ public class CglibFiltering5354Test
     @Test
     public void testWriteWithSpringCglibProxyDoesNotIncludeCallbacksProperty() throws Exception
     {
-        // 20-Oct-2025, tatu: Temporarily disable until #5357 merged
-        if (true) { return; }
-
         MockedSpringCglibProxy mockedProxy = new MockedSpringCglibProxy("hello");
         String json = MAPPER.writeValueAsString(mockedProxy);
         Map<?, ?> properties = MAPPER.readValue(json, Map.class);
         assertEquals(Collections.singleton("propertyName"), properties.keySet());
     }
 
     // https://github.com/FasterXML/jackson-databind/issues/5354
-    //@Test
+    @Test
     public void testWriteWithHibernateCglibProxyDoesNotIncludeCallbacksProperty() throws Exception
     {
         MockedHibernateCglibProxy mockedProxy = new MockedHibernateCglibProxy("hello");
@@ -44,7 +41,7 @@ public void testWriteWithHibernateCglibProxyDoesNotIncludeCallbacksProperty() th
     }
 
     // https://github.com/FasterXML/jackson-databind/issues/5354
-    //@Test
+    @Test
     public void testWriteWithNetCglibProxyDoesNotIncludeCallbacksProperty() throws Exception
     {
         MockedNetCglibProxy mockedProxy = new MockedNetCglibProxy("hello");