java.lang.StringBuffer cannot be deserialized

[Lolf1010]

Describe the bug
I recently tried to update my jackson-version from 2.10.3 to 2.13.1 and it appears that the java.lang.StringBuffer can no longer be deserialized. java.lang.StringBuilder and java.lang.String both work as expected.

Is there a reason why the support for StringBuffer was removed somewhere between the versions or is it a bug?

Version information
2.13.1

To Reproduce

ObjectMapper mapper = new ObjectMapper();
StringBuffer a = new StringBuffer("test");
String json = mapper.writeValueAsString(a);                  // is the string "test"
StringBuffer b = mapper.readValue(json, StringBuffer.class); // throws Exception

com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of `java.lang.StringBuffer` (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('test')

Expected behavior
java.lang.String, java.lang.StringBuilder, java.lang.StringBuffer can be serialized and deserialized.

EDIT (by @cowtowncoder )

Regression affects versions 2.12.x and 2.13.0 - 2.13.2; fixed in 2.13.3, did not affect versions up to 2.11.x.

[GedMarc]

Uhhhh, StringBuffer, is not recommended for use at all, why are you using it?

[Lolf1010]

I am not using it directly.
Groovy is using it.
https://docs.groovy-lang.org/latest/html/groovy-jdk/java/lang/String.html#leftShift(java.lang.Object)

In the project i am working at, where this issue occurred, is it possible for developers to define and execute groovy-scripts as part of BPMN-models that can be executed. Instead of using "+" to append strings, some where using "<<" which creates a StringBuffer instead of a String - for whatever reason. After the update, problems occurred in models with this operators since the deserialization failed.

Nevertheless, i expected all java.lang-String-Classes to be able to get serialized and deserialized.
Especially since StringBuffer is not marked deprecated - even in the newest version of java.
Maybe i miss the info in a changelog-file?

[cowtowncoder]

@Lolf1010 I can't remember any explicit change to cause this, so does sound like a bug.

At practical level, if there is no unit test to test certain functionality, it is not really supported feature -- if there was, we'd have had regression failure for whatever change occurred.
So I suspect only String and StringBuilder have test coverage.

I hope to have time to check this out, probably simple to fix.

[cowtowncoder]

Forgot to add a more meaningful update here along with the fix that went in Jackson 2.13.3 version.

So. Regression occurred in 2.12.0: formerly deserialization was working "accidentally" by Bean introspection finding single-String-arg constructor and using that. Introspection of core JDK classes was limited in 2.12 for security (primary) and performance (secondary) reasons, preventing this mechanism from working. And since there were no tests verifying deserializability (I added those with the fix), regression was not noticed.

Versions prior to 2.12.0 (2.11.x, 2.10.x etc) have working deserialization, as now does 2.13(.3). StringBuffer as a type is now supported wrt deserialization.