search

podnov / queryinfo

Apache License 2.0
1 stars 0 forks source link

Using an EntityQueryInfoBean doesn't validate that fields aren't leaked #12

Open podnov opened 8 years ago

podnov commented 8 years ago

When using an entity-based query info bean, the JPA CriteriaQuery select method causes the result object to have all jpa-defined fields. Should probably validate that fields not marked as QueryInfoField or QueryInfoFields marked as non-selectable are not included in the results.

podnov commented 8 years ago

In DefaultEntityQueryInfoSelectionSetter::setSelection, could just iterate selectable attributes and pass to CriteriaQuery::multiselect instead of CriteriaQuery::select. This would likely require custom Tuple deserialization as CriteraQuery::multiselect expects a matching constructor on the entity if you're not using Tuples as your result type.