[
https://issues.apache.org/jira/browse/CXF-3390?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13005171#comment-13005171
]
Ben Noordhuis commented on CXF-3390:
------------------------------------
Thanks, Sergey!
I actually started out with prototype-scoped beans. When that didn't work I
assumed I was doing something wrong and switched first to request and then
thread-local scoped beans.
This is something for another issue, but field values in request-scoped (CGLIB
AOP-proxied) beans are always null. Injection apparently fails but I'm not
quite sure why. If I have an hour to kill, I'll try to track down the cause.
Anyway, consider this issue resolved. :-) Thanks again!
> Field value from previous request is recycled when field is absent in new
> request
> ---------------------------------------------------------------------------------
>
> Key: CXF-3390
> URL: https://issues.apache.org/jira/browse/CXF-3390
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS
> Affects Versions: 2.4
> Reporter: Ben Noordhuis
> Priority: Critical
>
> This was tested against 2.3.1 and HEAD.
> Consider this class:
> {code}
> @Path("/test")
> public class Test {
> @QueryParam("q") private String q;
> @GET
> public void test() {
> System.err.println(q);
> }
> }
> {code}
> Now consider this test case:
> {noformat}
> $ curl http://localhost:8080/test # prints "null"
> $ curl http://localhost:8080/test?q=foo # prints "foo"
> $ curl http://localhost:8080/test # prints "foo" !
> {noformat}
> This is a serious bug because it leaks information. It's not specific to
> @QueryParam, the other annotations have the same problem.
> I discovered it in a resource that is used for authentication: after logging
> in once, I could log in again without providing a username and password!
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
