diff --git a/hapi-fhir-structures-r4/src/test/java/ca/uhn/fhir/rest/server/ServerMethodSelectionR4Test.java b/hapi-fhir-structures-r4/src/test/java/ca/uhn/fhir/rest/server/ServerMethodSelectionR4Test.java
new file mode 100644
index 00000000000..14fa05826ef
--- /dev/null
+++ b/hapi-fhir-structures-r4/src/test/java/ca/uhn/fhir/rest/server/ServerMethodSelectionR4Test.java
@@ -0,0 +1,190 @@
+package ca.uhn.fhir.rest.server;
+
+import ca.uhn.fhir.context.FhirContext;
+import ca.uhn.fhir.context.api.BundleInclusionRule;
+import ca.uhn.fhir.model.api.Include;
+import ca.uhn.fhir.rest.annotation.IncludeParam;
+import ca.uhn.fhir.rest.annotation.OptionalParam;
+import ca.uhn.fhir.rest.annotation.Search;
+import ca.uhn.fhir.rest.api.EncodingEnum;
+import ca.uhn.fhir.rest.client.api.IGenericClient;
+import ca.uhn.fhir.rest.server.exceptions.InvalidRequestException;
+import ca.uhn.fhir.test.utilities.JettyUtil;
+import com.google.common.collect.Lists;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.servlet.ServletHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
+import org.hl7.fhir.instance.model.api.IBaseResource;
+import org.hl7.fhir.r4.model.Bundle;
+import org.hl7.fhir.r4.model.Patient;
+import org.hl7.fhir.r4.model.StringType;
+import org.junit.After;
+import org.junit.Test;
+
+import java.util.List;
+import java.util.Set;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.junit.Assert.*;
+
+public class ServerMethodSelectionR4Test {
+
+
+ private FhirContext myCtx = FhirContext.forR4();
+ private Server myServer;
+ private IGenericClient myClient;
+
+ @After
+ public void after() throws Exception {
+ JettyUtil.closeServer(myServer);
+ }
+
+ /**
+ * Server method with no _include
+ * Client request with _include
+ *
+ * See #1421
+ */
+ @Test
+ public void testRejectIncludeIfNotProvided() throws Exception {
+
+ class MyProvider extends MyBaseProvider {
+ @Search
+ public List search(@OptionalParam(name = "name") StringType theName) {
+ return Lists.newArrayList(new Patient().setActive(true).setId("Patient/123"));
+ }
+ }
+ MyProvider provider = new MyProvider();
+
+ startServer(provider);
+
+ try {
+ myClient
+ .search()
+ .forResource(Patient.class)
+ .where(Patient.NAME.matches().value("foo"))
+ .include(Patient.INCLUDE_ORGANIZATION)
+ .execute();
+ fail();
+ } catch (InvalidRequestException e) {
+ assertThat(e.getMessage(), containsString("this server does not know how to handle GET operation[Patient] with parameters [[_include, name]]"));
+ }
+ }
+
+ /**
+ * Server method with no _include
+ * Client request with _include
+ *
+ * See #1421
+ */
+ @Test
+ public void testAllowIncludeIfProvided() throws Exception {
+
+ class MyProvider extends MyBaseProvider {
+ @Search
+ public List search(@OptionalParam(name = "name") StringType theName, @IncludeParam Set theIncludes) {
+ return Lists.newArrayList(new Patient().setActive(true).setId("Patient/123"));
+ }
+ }
+ MyProvider provider = new MyProvider();
+
+ startServer(provider);
+
+ Bundle results = myClient
+ .search()
+ .forResource(Patient.class)
+ .where(Patient.NAME.matches().value("foo"))
+ .include(Patient.INCLUDE_ORGANIZATION)
+ .returnBundle(Bundle.class)
+ .execute();
+ assertEquals(1, results.getEntry().size());
+ }
+
+ /**
+ * Server method with no _revinclude
+ * Client request with _revinclude
+ *
+ * See #1421
+ */
+ @Test
+ public void testRejectRevIncludeIfNotProvided() throws Exception {
+
+ class MyProvider extends MyBaseProvider {
+ @Search
+ public List search(@OptionalParam(name = "name") StringType theName) {
+ return Lists.newArrayList(new Patient().setActive(true).setId("Patient/123"));
+ }
+ }
+ MyProvider provider = new MyProvider();
+
+ startServer(provider);
+
+ try {
+ myClient
+ .search()
+ .forResource(Patient.class)
+ .where(Patient.NAME.matches().value("foo"))
+ .revInclude(Patient.INCLUDE_ORGANIZATION)
+ .execute();
+ fail();
+ } catch (InvalidRequestException e) {
+ assertThat(e.getMessage(), containsString("this server does not know how to handle GET operation[Patient] with parameters [[_revinclude, name]]"));
+ }
+ }
+
+ /**
+ * Server method with no _revInclude
+ * Client request with _revInclude
+ *
+ * See #1421
+ */
+ @Test
+ public void testAllowRevIncludeIfProvided() throws Exception {
+
+ class MyProvider extends MyBaseProvider {
+ @Search
+ public List search(@OptionalParam(name = "name") StringType theName, @IncludeParam(reverse = true) Set theRevIncludes) {
+ return Lists.newArrayList(new Patient().setActive(true).setId("Patient/123"));
+ }
+ }
+ MyProvider provider = new MyProvider();
+
+ startServer(provider);
+
+ Bundle results = myClient
+ .search()
+ .forResource(Patient.class)
+ .where(Patient.NAME.matches().value("foo"))
+ .revInclude(Patient.INCLUDE_ORGANIZATION)
+ .returnBundle(Bundle.class)
+ .execute();
+ assertEquals(1, results.getEntry().size());
+ }
+
+ private void startServer(Object theProvider) throws Exception {
+ RestfulServer servlet = new RestfulServer(myCtx);
+ servlet.registerProvider(theProvider);
+ ServletHandler proxyHandler = new ServletHandler();
+ servlet.setDefaultResponseEncoding(EncodingEnum.XML);
+ servlet.setBundleInclusionRule(BundleInclusionRule.BASED_ON_RESOURCE_PRESENCE);
+ ServletHolder servletHolder = new ServletHolder(servlet);
+ proxyHandler.addServletWithMapping(servletHolder, "/*");
+
+ myServer = new Server(0);
+ myServer.setHandler(proxyHandler);
+ JettyUtil.startServer(myServer);
+ int port = JettyUtil.getPortForStartedServer(myServer);
+
+ myClient = myCtx.newRestfulGenericClient("http://localhost:" + port);
+ }
+
+
+ public static class MyBaseProvider implements IResourceProvider {
+
+ @Override
+ public Class getResourceType() {
+ return Patient.class;
+ }
+ }
+
+}
diff --git a/hapi-fhir-structures-r5/pom.xml b/hapi-fhir-structures-r5/pom.xml
index d4d159e0a1b..43becf5f7ee 100644
--- a/hapi-fhir-structures-r5/pom.xml
+++ b/hapi-fhir-structures-r5/pom.xml
@@ -289,18 +289,6 @@
org.jacoco
jacoco-maven-plugin
-
- ${basedir}/target/classes
- ${basedir}/../hapi-fhir-base/target/classes
- ${basedir}/../hapi-fhir-client/target/classes
- ${basedir}/../hapi-fhir-server/target/classes
-
-
- ${basedir}/src/main/java
- ${basedir}/../hapi-fhir-base/src/main/java
- ${basedir}/../hapi-fhir-client/src/main/java
- ${basedir}/../hapi-fhir-server/src/main/java
-
true
diff --git a/hapi-fhir-validation/pom.xml b/hapi-fhir-validation/pom.xml
index d683e053690..d02d942675b 100644
--- a/hapi-fhir-validation/pom.xml
+++ b/hapi-fhir-validation/pom.xml
@@ -254,18 +254,6 @@
org.jacoco
jacoco-maven-plugin
-
- ${basedir}/target/classes
- ${basedir}/../hapi-fhir-base/target/classes
- ${basedir}/../hapi-fhir-client/target/classes
- ${basedir}/../hapi-fhir-server/target/classes
-
-
- ${basedir}/src/main/java
- ${basedir}/../hapi-fhir-base/src/main/java
- ${basedir}/../hapi-fhir-client/src/main/java
- ${basedir}/../hapi-fhir-server/src/main/java
-
true
diff --git a/pom.xml b/pom.xml
index ebb542bc664..55b1dd4ae39 100755
--- a/pom.xml
+++ b/pom.xml
@@ -607,7 +607,7 @@
4.4.11
4.5.9
2.9.9
- 2.9.9.1
+ 2.9.10
3.1.0
1.8
4.0.0.Beta3
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 293b3260a9a..bb0164e3909 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -13,6 +13,7 @@
Hibernate Core (Core): 5.4.2.Final -> 5.4.4.Final
+ Jackson Databind (JPA): 2.9.9 -> 2.9.10 (CVE-2019-16335, CVE-2019-14540)
]]>
@@ -212,6 +213,11 @@
with the new request id, resulting in an ever growing source.meta value. E.g. after the first update, it looks
like "#9f0a901387128111#5f37835ee38a89e2" when it should only be "#5f37835ee38a89e2". This has been corrected.
+
+ The Plain Server method selector was incorrectly allowing client requests with _include statements to be
+ handled by method implementations that did not have any @IncludeParam]]> defined. This
+ is now corrected. Thanks to Tuomo Ala-Vannesluoma for reporting and providing a test case!
+