[CXF-7702] Remove methods in QueryContext that don't use a custom bean class

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.5
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 05/Apr/18 13:33
• Updated: 25/Mar/19 12:28
• Resolved: 05/Apr/18 15:09

Description

The JAX-RS search QueryContext has some methods to return the converted search expression that don't take a bean parameter. This means that it's possible to inject parameters into the search query that are not defined as properties in the bean class, leading to potential injection attacks. Instead all methods should require a bean, similar to the SearchContext.