Add javadoc note on trusted broker setups for Spring JMS

Author: jhoeller

spring-jms/src/main/java/org/springframework/jms/core/JmsClient.java

@@ -73,6 +73,11 @@
  *     .receive();
  * </pre>
  *
+ * <p><b>Note that Spring's JMS setup is designed to be used against trusted
+ * broker setups, with trusted packages for {@code ObjectMessage} deserialization
+ * to be configured at the broker level (for example: in the ActiveMQ setup).</b>
+ * Alternatively, you may configure a custom {@link Builder#messageConverter converter}.
+ *
  * @author Juergen Hoeller
  * @author Brian Clozel
  * @since 7.0

spring-jms/src/main/java/org/springframework/jms/core/JmsTemplate.java

@@ -78,6 +78,11 @@
  * application's environment naming context via JNDI; application servers
  * typically expose pooled, transaction-aware factories there.
  *
+ * <p><b>Note that Spring's JMS setup is designed to be used against trusted
+ * broker setups, with trusted packages for {@code ObjectMessage} deserialization
+ * to be configured at the broker level (for example: in the ActiveMQ setup).</b>
+ * Alternatively, you may configure a custom {@link #setMessageConverter converter}.
+ *
  * @author Mark Pollack
  * @author Juergen Hoeller
  * @author Stephane Nicoll

spring-jms/src/main/java/org/springframework/jms/listener/DefaultMessageListenerContainer.java

@@ -119,6 +119,11 @@
  * "AUTO_ACKNOWLEDGE" mode, this container applies automatic message acknowledgment
  * before listener execution, with no redelivery in case of an exception.
  *
+ * <p><b>Note that Spring's JMS setup is designed to be used against trusted
+ * broker setups, with trusted packages for {@code ObjectMessage} deserialization
+ * to be configured at the broker level (for example: in the ActiveMQ setup).</b>
+ * Alternatively, you may configure a custom {@link #setMessageConverter converter}.
+ *
  * @author Juergen Hoeller
  * @author Sam Brannen
  * @since 2.0

spring-jms/src/main/java/org/springframework/jms/listener/SimpleMessageListenerContainer.java

@@ -59,6 +59,11 @@
  * transactional receipt of messages (registering them with XA transactions),
  * see {@link DefaultMessageListenerContainer}.
  *
+ * <p><b>Note that Spring's JMS setup is designed to be used against trusted
+ * broker setups, with trusted packages for {@code ObjectMessage} deserialization
+ * to be configured at the broker level (for example: in the ActiveMQ setup).</b>
+ * Alternatively, you may configure a custom {@link #setMessageConverter converter}.
+ *
  * @author Juergen Hoeller
  * @since 2.0
  * @see jakarta.jms.MessageConsumer#setMessageListener

spring-jms/src/main/java/org/springframework/jms/support/converter/SimpleMessageConverter.java

@@ -41,6 +41,10 @@
  * {@link jakarta.jms.BytesMessage}, a Map to a {@link jakarta.jms.MapMessage}, and
  * a Serializable object to a {@link jakarta.jms.ObjectMessage} (or vice versa).
  *
+ * <p><b>Note that this converter must only be used against trusted broker setups,
+ * with trusted packages for {@code ObjectMessage} deserialization to be configured
+ * at the broker level (for example: in the ActiveMQ setup) if necessary.</b>
+ *
  * @author Juergen Hoeller
  * @author Sam Brannen
  * @since 1.1