Open Querybuilder Endpoint on Publisher

Hi @gunars_v,

Exposing the QueryBuilder endpoint (/bin/querybuilder.json) on the publisher is generally not recommended unless you're very careful - this endpoint can be used to craft expensive or malicious queries that may impact performance or expose sensitive content.

If you must expose it for a third-party service, here’s how to harden the configuration as much as possible:

1. Restrict by query pattern (as you're doing)

Continue using the /query filter with a strict regex that matches only the expected and safe query structure:

/url "/bin/querybuilder.json"
/method "GET"
/extension "json"
/query "your-safe-regex"

Make sure this regex:

• Only allows known paths

• Prevents deep traversals like path=/content without limit

• Does not allow dynamic filters (like orderby, nodename, etc.)

2. Restrict by IP or client certificate

If the third-party system has a static IP, restrict access to only that IP:

/allow {
  /type "allow"
/url "/bin/querybuilder.json"
/method "GET"
/extension "json"
/query "your-safe-regex"
/ip "198.51.100.25"
}

Or configure client certificate-based access (mutual TLS) if applicable.

3. Rate limiting (Optional but recommended)

Apply rate limits via your load balancer or WAF (e.g., Cloudflare, Akamai, etc.) to prevent abuse.

4. Use a custom servlet or wrapper instead

Instead of exposing /bin/querybuilder.json, you can create a custom servlet that:

• Internally uses QueryBuilder

• Validates and sanitizes all inputs

• Returns only the specific data needed

Then expose only this custom endpoint in Dispatcher. This gives you full control.

Hope that helps!