[OLINGO-1620] Incorrect validation of odata.bind annotation

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: (Java) V4 4.9.0, (Java) V4 4.10.0, Version (Java) V4 5.0.0
• Component/s: odata4-server
• Assignee: Unassigned
• Reporter: Florent Albert
• Created: 06/May/24 18:33
• Updated: 06/May/24 18:33

Description

Steps to reproduce:

• Make a POST request with a JSON body containing a bind operation. For example:

  • {
       "Name":"A Name",
       "[e-mail]12345":"Product(12)"
    }
    

The JSON deserializer will consider @odata.bind12345 as being well formed and will pass the binding link down to the processors.

This is because the deserializer only does a partial checks (String.contains()) on the JSON field key: https://github.com/apache/olingo-odata4/blob/20b0d7a2c0134d00cd86ef42545bf4af9b254d32/lib/server-core/src/main/java/org/apache/olingo/server/core/deserializer/json/ODataJsonDeserializer.java#L460

Instead, it should be an exact match.