jsonArrayContains is a GeoServer filter function used during query processing to test whether a JSON array contains a given value. In practice, it helps turn a client’s filter expression into a database-friendly condition that can narrow map or feature results.
It matters because filter functions sit on the boundary between untrusted input and backend query generation. If that boundary is handled unsafely, an attacker may be able to influence the resulting SQL instead of just the intended search criteria. In real attacks, this kind of weakness can lead to SQL injection when a crafted filter reaches the datastore without proper validation or parameterization. Defenders should review any service that exposes OGC-style queries, restrict anonymous access where possible, and treat filter parsing as part of the application’s trust boundary. Least-privilege database accounts and careful input handling reduce the chance that a parsing bug becomes a full compromise.