Consider Jackson customizations are considered when building a Querydsl Predicate instance.

Fixes GH-2572.

Author: christophstrobl

spring-data-rest-tests/spring-data-rest-tests-mongodb/src/main/java/org/springframework/data/rest/tests/mongodb/User.java

@@ -26,6 +26,7 @@
 import org.springframework.data.mongodb.core.mapping.DBRef;
 import org.springframework.data.mongodb.core.mapping.Document;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonValue;
 
 /**
@@ -51,6 +52,7 @@ public static enum Gender {
 	public @DBRef(lazy = true) User manager;
 	public @DBRef(lazy = true) Map<String, User> map;
 	public Map<String, Nested> colleaguesMap = new HashMap<String, Nested>();
+	public @JsonIgnore String ignored;
 
 	public static class EmailAddress {
 

spring-data-rest-tests/spring-data-rest-tests-mongodb/src/test/java/org/springframework/data/rest/webmvc/config/QuerydslAwareRootResourceInformationHandlerMethodArgumentResolverUnitTests.java

@@ -20,16 +20,22 @@
 import static org.mockito.Mockito.*;
 
 import java.util.Collections;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.function.Function;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.core.MethodParameter;
+import org.springframework.data.mapping.context.PersistentEntities;
+import org.springframework.data.mongodb.core.convert.MongoCustomConversions;
+import org.springframework.data.mongodb.core.mapping.MongoMappingContext;
 import org.springframework.data.querydsl.QuerydslPredicateExecutor;
 import org.springframework.data.querydsl.QuerydslRepositoryInvokerAdapter;
 import org.springframework.data.querydsl.SimpleEntityPathResolver;
@@ -41,12 +47,16 @@
 import org.springframework.data.repository.support.Repositories;
 import org.springframework.data.repository.support.RepositoryInvoker;
 import org.springframework.data.repository.support.RepositoryInvokerFactory;
+import org.springframework.data.rest.tests.mongodb.Profile;
 import org.springframework.data.rest.tests.mongodb.QUser;
 import org.springframework.data.rest.tests.mongodb.Receipt;
 import org.springframework.data.rest.tests.mongodb.ReceiptRepository;
 import org.springframework.data.rest.tests.mongodb.User;
+import org.springframework.data.rest.webmvc.json.MappedProperties;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.util.MultiValueMap;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.querydsl.core.types.Predicate;
 
 /**
@@ -68,15 +78,28 @@ class QuerydslAwareRootResourceInformationHandlerMethodArgumentResolverUnitTests
 	@Mock MethodParameter parameter;
 
 	QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver resolver;
+	Function<Class<?>, MappedProperties> jacksonPropertiesLookup;
 
 	@BeforeEach
 	void setUp() {
 
 		QuerydslBindingsFactory factory = new QuerydslBindingsFactory(SimpleEntityPathResolver.INSTANCE);
 		ReflectionTestUtils.setField(factory, "repositories", Optional.of(repositories));
 
+		MongoCustomConversions conversions = new MongoCustomConversions(Collections.emptyList());
+		MongoMappingContext mappingContext = new MongoMappingContext();
+		mappingContext.setSimpleTypeHolder(conversions.getSimpleTypeHolder());
+		mappingContext.getPersistentEntity(User.class);
+		mappingContext.getPersistentEntity(Receipt.class);
+		mappingContext.getPersistentEntity(Profile.class);
+		PersistentEntities entities = new PersistentEntities(List.of(mappingContext));
+
+		ObjectMapper mapper = new ObjectMapper();
+		this.jacksonPropertiesLookup = type -> entities.getPersistentEntity(type)
+				.map(entity -> MappedProperties.forSerialization(entity, mapper)).orElse(null);
+
 		this.resolver = new QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver(repositories, invokerFactory,
-				resourceMetadataResolver, builder, factory);
+				resourceMetadataResolver, builder, factory, jacksonPropertiesLookup);
 
 		when(builder.getPredicate(any(), any(), any())).thenReturn(mock(Predicate.class));
 		when(parameter.hasParameterAnnotation(QuerydslPredicate.class)).thenReturn(true);
@@ -116,8 +139,50 @@ void invokesCustomizationOnRepositoryIfItImplementsCustomizer() {
 		verify(repository, times(1)).customize(Mockito.any(QuerydslBindings.class), Mockito.any(QUser.class));
 	}
 
+	@Test // GH-2572
+	void doesNotExposeJsonIgnoredPropertiesAsFilterKeys() {
+
+		Object repository = mock(QuerydslUserRepository.class);
+		when(repositories.getRepositoryFor(User.class)).thenReturn(Optional.of(repository));
+
+		Map<String, String[]> parameters = Map.of("ignored", new String[] { "candidate-value" });
+
+		ArgumentCaptor<MultiValueMap<String, String>> captor = ArgumentCaptor.captor();
+		when(builder.getPredicate(any(), captor.capture(), any())).thenReturn(mock(Predicate.class));
+
+		resolver.postProcess(parameter, invoker, User.class, parameters);
+
+		// Querydsl never receives a parameter that maps to a @JsonIgnore-annotated property: it could otherwise be used
+		// as a server-side filter key (and as an existence oracle) for a value the framework refuses to serialize.
+		assertThat(captor.getValue()).doesNotContainKey("ignored");
+	}
+
+	@Test // GH-2572
+	void translatesJacksonRenamedPropertyToPersistentPropertyName() {
+
+		Object repository = mock(QuerydslProfileRepository.class);
+		when(repositories.getRepositoryFor(Profile.class)).thenReturn(Optional.of(repository));
+
+		// Profile.aliased is exposed as "renamed" via @JsonProperty("renamed"). A request that addresses the public alias
+		// must reach Querydsl under the underlying domain property name; the bare Java field name must not be accepted.
+		Map<String, String[]> parameters = Map.of(
+				"renamed", new String[] { "value" },
+				"aliased", new String[] { "ignored" });
+
+		ArgumentCaptor<MultiValueMap<String, String>> captor = ArgumentCaptor.captor();
+		when(builder.getPredicate(any(), captor.capture(), any())).thenReturn(mock(Predicate.class));
+
+		resolver.postProcess(parameter, invoker, Profile.class, parameters);
+
+		MultiValueMap<String, String> forwarded = captor.getValue();
+		assertThat(forwarded).doesNotContainKey("renamed");
+		assertThat(forwarded.get("aliased")).containsExactly("value");
+	}
+
 	interface QuerydslUserRepository extends QuerydslPredicateExecutor<User> {}
 
+	interface QuerydslProfileRepository extends QuerydslPredicateExecutor<Profile> {}
+
 	interface QuerydslCustomizingUserRepository
 			extends QuerydslPredicateExecutor<User>, QuerydslBinderCustomizer<QUser> {}
 }

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/config/QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver.java

@@ -16,11 +16,14 @@
 package org.springframework.data.rest.webmvc.config;
 
 import java.util.Arrays;
+import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
+import java.util.function.Function;
 
 import org.springframework.core.MethodParameter;
+import org.springframework.data.mapping.PersistentProperty;
 import org.springframework.data.querydsl.QuerydslPredicateExecutor;
 import org.springframework.data.querydsl.QuerydslRepositoryInvokerAdapter;
 import org.springframework.data.querydsl.binding.QuerydslBindings;
@@ -31,8 +34,9 @@
 import org.springframework.data.repository.support.RepositoryInvoker;
 import org.springframework.data.repository.support.RepositoryInvokerFactory;
 import org.springframework.data.rest.webmvc.RootResourceInformation;
-import org.springframework.data.util.Pair;
+import org.springframework.data.rest.webmvc.json.MappedProperties;
 import org.springframework.data.util.ClassTypeInformation;
+import org.springframework.data.util.Pair;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
@@ -53,6 +57,7 @@ class QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver
 	private final Repositories repositories;
 	private final QuerydslPredicateBuilder predicateBuilder;
 	private final QuerydslBindingsFactory factory;
+	private final Function<Class<?>, MappedProperties> jacksonPropertiesLookup;
 
 	/**
 	 * Creates a new {@link QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver} using the given
@@ -61,16 +66,21 @@ class QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver
 	 * @param repositories must not be {@literal null}.
 	 * @param invokerFactory must not be {@literal null}.
 	 * @param resourceMetadataResolver must not be {@literal null}.
+	 * @param jacksonPropertiesLookup must not be {@literal null}. May return {@literal null} for domain types that are
+	 *          not managed as persistent entities, in which case the request parameter map is forwarded to Querydsl
+	 *          unfiltered.
 	 */
 	public QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver(Repositories repositories,
 			RepositoryInvokerFactory invokerFactory, ResourceMetadataHandlerMethodArgumentResolver resourceMetadataResolver,
-			QuerydslPredicateBuilder predicateBuilder, QuerydslBindingsFactory factory) {
+			QuerydslPredicateBuilder predicateBuilder, QuerydslBindingsFactory factory,
+			Function<Class<?>, MappedProperties> jacksonPropertiesLookup) {
 
 		super(repositories, invokerFactory, resourceMetadataResolver);
 
 		this.repositories = repositories;
 		this.predicateBuilder = predicateBuilder;
 		this.factory = factory;
+		this.jacksonPropertiesLookup = jacksonPropertiesLookup;
 	}
 
 	@Override
@@ -92,14 +102,45 @@ protected RepositoryInvoker postProcess(MethodParameter parameter, RepositoryInv
 	private Optional<Pair<QuerydslPredicateExecutor<?>, Predicate>> getRepositoryAndPredicate(
 			QuerydslPredicateExecutor<?> repository, Class<?> domainType, Map<String, String[]> parameters) {
 
+		Map<String, String[]> filteredParameters = filterByJacksonVisibility(domainType, parameters);
+
 		ClassTypeInformation<?> type = ClassTypeInformation.from(domainType);
 
 		QuerydslBindings bindings = factory.createBindingsFor(type);
-		Predicate predicate = predicateBuilder.getPredicate(type, toMultiValueMap(parameters), bindings);
+		Predicate predicate = predicateBuilder.getPredicate(type, toMultiValueMap(filteredParameters), bindings);
 
 		return Optional.ofNullable(predicate).map(it -> Pair.of(repository, it));
 	}
 
+	/**
+	 * Reduces the request parameter map to entries that map to properties Jackson would expose in serialized responses
+	 * for {@code domainType}, translating Jackson field names to the underlying persistent property names that Querydsl
+	 * operates on. Without this gate, properties hidden from serialization (e.g. via {@code @JsonIgnore}) would still
+	 * be available as server-side filter keys via Querydsl's default permit-all bindings, and Jackson-renamed
+	 * properties (e.g. {@code @JsonProperty("renamed")}) would not be addressable under their public alias.
+	 */
+	private Map<String, String[]> filterByJacksonVisibility(Class<?> domainType, Map<String, String[]> parameters) {
+
+		MappedProperties properties = jacksonPropertiesLookup.apply(domainType);
+
+		if (properties == null) {
+			return parameters;
+		}
+
+		Map<String, String[]> filtered = new LinkedHashMap<>(parameters.size());
+
+		for (Entry<String, String[]> entry : parameters.entrySet()) {
+
+			PersistentProperty<?> property = properties.getPersistentProperty(entry.getKey());
+
+			if (property != null) {
+				filtered.put(property.getName(), entry.getValue());
+			}
+		}
+
+		return filtered;
+	}
+
 	@SuppressWarnings("unchecked")
 	private static RepositoryInvoker getQuerydslAdapter(RepositoryInvoker invoker,
 			QuerydslPredicateExecutor<?> repository, Predicate predicate) {

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/config/RepositoryRestMvcConfiguration.java

@@ -427,8 +427,13 @@ public RootResourceInformationHandlerMethodArgumentResolver repoRequestArgumentR
 			QuerydslPredicateBuilder predicateBuilder = new QuerydslPredicateBuilder(defaultConversionService,
 					factory.getEntityPathResolver());
 
+			ObjectMapper mapper = objectMapper();
+			PersistentEntities entities = persistentEntities();
+
 			return new QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver(repositories,
-					repositoryInvokerFactory, resourceMetadataHandlerMethodArgumentResolver, predicateBuilder, factory);
+					repositoryInvokerFactory, resourceMetadataHandlerMethodArgumentResolver, predicateBuilder, factory,
+					type -> entities.getPersistentEntity(type)
+							.map(entity -> MappedProperties.forSerialization(entity, mapper)).orElse(null));
 		}
 
 		return new RootResourceInformationHandlerMethodArgumentResolver(repositories, repositoryInvokerFactory,

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/json/MappedProperties.java

@@ -45,7 +45,7 @@
  * @author Mark Paluch
  * @author Mathias Düsterhöft
  */
-class MappedProperties {
+public class MappedProperties {
 
 	private final Map<PersistentProperty<?>, BeanPropertyDefinition> propertyToFieldName;
 	private final Map<String, PersistentProperty<?>> fieldNameToProperty;