🔒 Fix JPQL injection vulnerability in findByFilter methods

[ManupaKDU]

🎯 What:
Fixed a JPQL injection vulnerability present in the findByFilter(String property, String value) method across 8 different JSF backing bean controllers:

• OpdPreBillController.java
• BillController.java
• OpdBatchBillCancellationController.java
• OpdTabPreBillController.java
• CollectingCentreBillController.java
• OpticianRepairBillController.java
• OpdBillController.java
• OpdOrderController.java

⚠️ Risk:
The findByFilter method constructed a JPQL query using direct string concatenation:
String sql = "Select b From Bill b where b.retired=false and upper(b." + property + ") like :val";

Since column/property names cannot be parameterized in JPQL, an attacker who could control the property argument (e.g., via manipulating request parameters in the UI) could inject arbitrary JPQL syntax. This could potentially allow them to bypass security controls, exfiltrate data, or cause Denial of Service by constructing expensive queries.

🛡️ Solution:
Added a strict allowlist regex validation check at the beginning of the findByFilter method in all affected controllers.

if (property == null || !property.matches("^[a-zA-Z0-9_\\.]+$")) {
    return false;
}

If the property string contains any characters other than alphanumeric characters, underscores, or dots (which are valid for property traversal like patient.person.name), the method immediately returns false without executing the query, safely mitigating the injection risk.

---

PR created automatically by Jules for task 16725718353099065624 started by @manupawickramasinghe

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.