From 942a922038181102cae8c8e737f015d0a6879d2d Mon Sep 17 00:00:00 2001
From: Michael Reiche <48999328+mikereiche@users.noreply.github.com>
Date: Wed, 23 Apr 2025 17:59:16 -0700
Subject: [PATCH] Switch to OpenFeign QueryDSL (#2050)

because of CVE-2024-49203.

Closes #2409.

Signed-off-by: mikereiche <michael.reiche@couchbase.com>
---
 pom.xml                                                  | 6 +++---
 .../CouchbaseRepositoryQuerydslIntegrationTests.java     | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 7f3334f0..7517e1a9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,6 +26,7 @@
         <jodatime>2.10.13</jodatime>
         <jackson-joda>2.13.4</jackson-joda>
         <jakarta.el>4.0.0</jakarta.el>
+        <querydsl_of>6.11</querydsl_of>
     </properties>
 
     <dependencyManagement>
@@ -43,10 +44,9 @@
     <dependencies>
 
         <dependency>
-            <groupId>com.querydsl</groupId>
+            <groupId>io.github.openfeign.querydsl</groupId>
             <artifactId>querydsl-apt</artifactId>
-            <version>${querydsl}</version>
-            <classifier>jakarta</classifier>
+            <version>${querydsl_of}</version>
             <scope>provided</scope>
         </dependency>
 
diff --git a/src/test/java/org/springframework/data/couchbase/repository/query/CouchbaseRepositoryQuerydslIntegrationTests.java b/src/test/java/org/springframework/data/couchbase/repository/query/CouchbaseRepositoryQuerydslIntegrationTests.java
index 600b0cb1..cb8d3fea 100644
--- a/src/test/java/org/springframework/data/couchbase/repository/query/CouchbaseRepositoryQuerydslIntegrationTests.java
+++ b/src/test/java/org/springframework/data/couchbase/repository/query/CouchbaseRepositoryQuerydslIntegrationTests.java
@@ -20,6 +20,7 @@ import static com.couchbase.client.java.query.QueryScanConsistency.REQUEST_PLUS;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.springframework.data.couchbase.util.Util.comprises;
 import static org.springframework.data.couchbase.util.Util.exactly;
 
@@ -29,6 +30,7 @@ import java.util.Locale;
 import java.util.Optional;
 import java.util.stream.StreamSupport;
 
+import com.querydsl.core.types.dsl.PathBuilder;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
@@ -147,6 +149,13 @@ public class CouchbaseRepositoryQuerydslIntegrationTests extends JavaIntegration
 		}
 	}
 
+	@Test
+	void testInjection() {
+		String userSpecifiedPath = "1 = 1) OR (2";
+		PathBuilder<QAirline> pathBuilder = new PathBuilder<>(QAirline.class, "xyz");
+		assertThrows(IllegalStateException.class, () -> pathBuilder.get(userSpecifiedPath).eq("2"));
+	}
+
 	// this gives hqCountry == "" and hqCountry is missing
 	// @Test
 	void testStringIsEmpty() {