Spring-Kafka :反序列化kafka消息类时的问题不在“受信任的包”中？

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // ... 其他配置 ...
            .headers()
                .frameOptions().sameOrigin()
                .and()
            .csrf().disable()
            .and()
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Bean
    public KafkaListenerContainerFactory<?> kafkaListenerContainerFactory(
            ConcurrentKafkaListenerContainerFactoryConfigurer configurer,
            ConsumerFactory<Object, Object> consumerFactory) {
        ConcurrentKafkaListenerContainerFactory<Object, Object> factory =
                new ConcurrentKafkaListenerContainerFactory<>();
        configurer.configure(factory, consumerFactory);

        // 设置反序列化器
        factory.getContainerProperties().setPollTimeout(3000);
        factory.getContainerProperties().setAckMode(ContainerProperties.AckMode.MANUAL);
        factory.getContainerProperties().setClientIdPrefix("client-id-");
        factory.getContainerProperties().setTransactionIdPrefix("tx-id-");

        // 配置受信任的包
        factory.setBeanFactory(new DefaultListableBeanFactory() {
            @Override
            protected void customizeBeanFactory(DefaultListableBeanFactory beanFactory) {
                super.customizeBeanFactory(beanFactory);
                beanFactory.addBeanPostProcessor(new BeanPostProcessor() {
                    @Override
                    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
                        return bean;
                    }

                    @Override
                    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
                        if (bean instanceof KafkaMessageConverter) {
                            ((KafkaMessageConverter) bean).setTrustedPackages(Arrays.asList("com.example.package"));
                        }
                        return bean;
                    }
                });
            }
        });

        return factory;
    }
}

@KafkaListener(topics = "test-topic", properties = {
    "security.protocol=SASL_PLAINTEXT",
    "sasl.mechanism=PLAIN",
    "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"admin\";",
    "allow.auto.create.topics=true",
    "auto.offset.reset=earliest",
    "key.deserializer=org.apache.kafka.common.serialization.StringDeserializer",
    "value.deserializer=org.springframework.kafka.support.serializer.ErrorHandlingDeserializer",
    "value.deserializer.org.springframework.kafka.support.serializer.JsonDeserializer.trustedPackages=com.example.package"
})
public void listen(ConsumerRecord<String, MyMessage> record) {
    // 处理消息
}

public class CustomDeserializer implements Deserializer<MyMessage> {

    @Override
    public MyMessage deserialize(String topic, byte[] data) {
        try (ByteArrayInputStream bis = new ByteArrayInputStream(data);
             ObjectInput in = new ObjectInputStream(bis)) {
            in.setObjectInputFilter(filterInfo -> {
                if (filterInfo.serialClass() != null && filterInfo.serialClass().getName().startsWith("com.example.package")) {
                    return ObjectInputFilter.Status.ALLOWED;
                } else {
                    return ObjectInputFilter.Status.REJECTED;
                }
            });
            return (MyMessage) in.readObject();
        } catch (IOException | ClassNotFoundException e) {
            throw new RuntimeException("Failed to deserialize message", e);
        }
    }

    @Override
    public void configure(Map<String, ?> configs, boolean isKey) {
        // 配置相关参数
    }

    @Override
    public void close() {
        // 关闭资源
    }
}

@Bean
public Map<String, Object> consumerConfigs() {
    Map<String, Object> props = new HashMap<>();
    props.put(ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG, "localhost:9092");
    props.put(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG, StringDeserializer.class);
    props.put(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG, CustomDeserializer.class);
    return props;
}