rt/transports/http-netty/netty-client/src/main/java/org/apache/cxf/transport/http/netty/client/NettyHttpConduit.java (4 lines):
	- line 222: // TODO need to check how to set the Chunked feature
	- line 558: // TODO we need to deal with the Chunked information ourself
	- line 608: // TODO we need to support it
	- line 701: //TODO need to support the chunked version


rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/AbstractXmlEncInHandler.java (4 lines):
	- line 123: //TODO: support EncryptedData/ds:KeyInfo - the encrypted key is passed out of band
	- line 173: * TODO: the following can be easily supported too
	- line 225: //TODO: Support symmetric keys if requested
	- line 234: //TODO: Support symmetric keys if requested


rt/rs/description/src/main/java/org/apache/cxf/jaxrs/model/wadl/WadlGenerator.java (4 lines):
	- line 1067: // TODO: Collapse multiple parameters into a holder
	- line 1241: // TODO: deal with caching later on
	- line 1344: // TODO: deal with caching later on
	- line 1680: // TODO : can we reuse this block with JAXBBinding somehow ?


rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java (3 lines):
	- line 712: // TODO We only support using a KeyIdentifier for the moment
	- line 1713: //TODO This is a hack, this should not come under USE_REQ_SIG_CERT
	- line 2121: // TODO Add support for SAML2 here


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/soap/RedeliveryQueueImpl.java (3 lines):
	- line 330: // TODO use a constant op instead of this inefficient linear op
	- line 395: //TODO refactor this class to unify its functionality with that of ResendCandidate
	- line 577: //TODO release the message and later reload it upon resume


core/src/main/java/org/apache/cxf/common/jaxb/JAXBUtils.java (3 lines):
	- line 592: //TODO: review and remove this after JDK11
	- line 777: //TODO: review and remove this check
	- line 1107: //TODO: review and remove "com.sun" package name check


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMEndpoint.java (3 lines):
	- line 486: // TODO: FaultPolicy (SequenceFault)
	- line 502: // TODO: FaultInfo (SequenceFault)
	- line 685: // TODO: BindingFaultInfo (SequenceFault)


core/src/main/java/org/apache/cxf/common/util/SpringClasspathScanner.java (3 lines):
	- line 43: //TODO: [OSGi+Jakarta] uncoment this when osgi comes back
	- line 50: //TODO: [OSGi+Jakarta] uncoment this when osgi comes back
	- line 175: //TODO: [OSGi+Jakarta] uncoment this when osgi comes back


rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/DynamicRegistrationService.java (3 lines):
	- line 153: // TODO: consider making Client secret time limited
	- line 249: //TODO: default is expected to be set to OAuthConstants.TOKEN_ENDPOINT_AUTH_BASIC
	- line 344: //TODO: check other properties


rt/databinding/jaxb/src/main/java/org/apache/cxf/jaxb/JAXBEncoderDecoder.java (2 lines):
	- line 283: //TODO: cache the JAXBRIContext
	- line 317: //  TODO: cache the JAXBRIContext


rt/transports/http-jetty/src/main/java/org/apache/cxf/transport/http_jetty/JettyHTTPServerEngine.java (2 lines):
	- line 960: // TODO Once we switch to use SslContextFactory.Server instead, we can get rid of this line
	- line 1392: bufferSize = Math.min(8192, bufferSize); // TODO ?


integration/jca/src/main/java/org/apache/cxf/jca/cxf/JCABusFactory.java (2 lines):
	- line 76: //TODO Check for the managed connection factory properties
	- line 77: //TODO We may need get the configuration file from properties


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java (2 lines):
	- line 306: //TODO: validate JWS specific constraints
	- line 407: //TODO: optionally validate inHeaders.getAlgorithm against a property in props


core/src/main/java/org/apache/cxf/bus/spring/SpringBeanLocator.java (2 lines):
	- line 81: //TODO: [OSGi+Jakarta] Uncomment this when osgi comes back
	- line 155: //TODO: [OSGi+Jakarta] Uncomment this when osgi comes back


rt/wsdl/src/main/java/org/apache/cxf/wsdl11/WSDLServiceBuilder.java (2 lines):
	- line 330: //TODO: wsdl4j's bug. if there is recursive import,
	- line 442: // TODO: this is really ugly, but how to link between


rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractSSOSpHandler.java (2 lines):
	- line 105: //TODO: support attaching a signature to the cookie value
	- line 137: //TODO: Consider adding an 'HttpOnly' attribute


services/wsn/wsn-core/src/main/java/org/apache/cxf/wsn/services/JaxwsSubscription.java (2 lines):
	- line 62: // TODO: implement raw notifications
	- line 78: // TODO: implement raw notifications


rt/ws/policy/src/main/java/org/apache/cxf/ws/policy/ServiceModelPolicyUpdater.java (2 lines):
	- line 84: // FIXME - since the appliesTo is for BindingOperationInfo, I think its dodgy
	- line 119: // TODO - do I need to defensively copy this?


services/ws-discovery/ws-discovery-api/src/main/java/org/apache/cxf/ws/discovery/internal/WSDiscoveryServiceImpl.java (2 lines):
	- line 566: // TODO Auto-generated catch block
	- line 569: // TODO Auto-generated catch block


rt/transports/websocket/src/main/java/org/apache/cxf/transport/websocket/ahc/AhcWebSocketConduit.java (2 lines):
	- line 231: //TODO return a generic message based on the status code
	- line 256: // TODO add proxy support ...


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java (2 lines):
	- line 737: //TODO: Validate JWE specific constraints
	- line 1029: //TODO: consider loading all the public keys in the store


tools/wadlto/jaxrs/src/main/java/org/apache/cxf/tools/wadlto/jaxrs/SourceGenerator.java (2 lines):
	- line 1033: sbCode.append("//TODO: implement").append(lineSeparator).append(TAB);
	- line 1902: // TODO: CXF code should have a better solution somewhere, we'll get back to it


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/soap/RMSoapInInterceptor.java (2 lines):
	- line 132: // TODO: decode SequenceFault ?
	- line 293: //TODO add server-side TSR handling


rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java (2 lines):
	- line 236: * TODO - hook up these policies
	- line 434: //TODO how to deal with the fields


rt/transports/http-netty/netty-server/src/main/java/org/apache/cxf/transport/http/netty/server/NettyHttpServerEngine.java (2 lines):
	- line 86: // TODO need to setup configuration about them
	- line 95: // TODO need to setup configuration about them


rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/util/stax/JDOMStreamWriter.java (2 lines):
	- line 164: // TODO: set encoding/version
	- line 170: // TODO: set encoding/version


rt/rs/microprofile-client/src/main/java/org/apache/cxf/microprofile/client/cdi/RestClientBean.java (2 lines):
	- line 411: //TODO: replace getResources lookup with getResourceAsStream once
	- line 423: LOG.warning("could not find classpath:" + location); //TODO: new message


rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java (2 lines):
	- line 589: // TODO : ensure chunking can be enabled for non-empty PUTs - if requested
	- line 592: //TODO: The chunking mode be configured or at least some


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java (1 line):
	- line 358: //TODO: enhance the certificate validation code


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/spring/RMFeatureBeanDefinitionParser.java (1 line):
	- line 49: // TODO: handle


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/DestinationSequence.java (1 line):
	- line 254: // TODO: should also check if we allow breaking the WI Profile rule by which no headers


rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/SamlEnvelopedOutInterceptor.java (1 line):
	- line 100: // TODO: this is not critical now - but figure out if we can avoid copying


rt/rs/description-openapi-v3/src/main/java/org/apache/cxf/jaxrs/openapi/parse/OpenApiParseUtils.java (1 line):
	- line 234: // TODO: need to know the package name


maven-plugins/wadl2java-plugin/src/main/java/org/apache/cxf/maven_plugin/wadlto/WadlOption.java (1 line):
	- line 165: // TODO: the following 3 helpers can go to a superclass or common utility class


rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPTransportFactory.java (1 line):
	- line 227: * TODO: What are the formal constraints on EndpointInfo and


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/InjectionUtils.java (1 line):
	- line 1085: // TODO : investigate the possibility of using generic proxies only


services/xkms/xkms-service/src/main/java/org/apache/cxf/xkms/service/XKMSService.java (1 line):
	- line 237: // TODO refactoring into factory class?


tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/CustomizationParser.java (1 line):
	- line 269: //TODO: check for valid extension namespaces


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwa/AlgorithmUtils.java (1 line):
	- line 261: //TODO: perhaps a key should be a name+keysize pair


rt/transports/websocket/src/main/java/org/apache/cxf/transport/websocket/atmosphere/AtmosphereWebSocketServletDestination.java (1 line):
	- line 102: // TODO Auto-generated catch block


rt/management/src/main/java/org/apache/cxf/management/interceptor/PersistOutInterceptor.java (1 line):
	- line 189: // TODO: handle exception


rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java (1 line):
	- line 247: // TODO: get bundle resource message once this filter is moved


services/wsn/wsn-core/src/main/java/org/apache/cxf/wsn/AbstractSubscription.java (1 line):
	- line 394: // TODO check we can resolve endpoint


rt/transports/http-hc/src/main/java/org/apache/cxf/transport/http/asyncclient/URLConnectionAsyncHTTPConduit.java (1 line):
	- line 583: // TODO Auto-generated catch block


tools/corba/src/main/java/org/apache/cxf/tools/corba/processors/wsdl/WSDLToCorbaHelper.java (1 line):
	- line 1306: * TODO: why are we looking up an element name with findSchemaType?


core/src/main/java/org/apache/cxf/ws/addressing/VersionTransformer.java (1 line):
	- line 268: // TODO ref parameters not present in 2004/03


rt/rs/description-openapi-v3/src/main/java/org/apache/cxf/jaxrs/openapi/SwaggerUi.java (1 line):
	- line 32: //TODO: [OSGi+Jakarta] uncomment this when osgi comes back


rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java (1 line):
	- line 158: //TODO: OIDC core talks about various security algorithm preferences


rt/databinding/jaxb/src/main/java/org/apache/cxf/jaxb/io/DataWriterImpl.java (1 line):
	- line 243: //TODO:Cache the JAXBRIContext


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/interceptor/JAXRSOutInterceptor.java (1 line):
	- line 485: // TODO : Pushing the filter processing and copying response headers into say


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/StreamingResponseProvider.java (1 line):
	- line 55: //TODO: review the possibility of caching the providers


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/AbstractJAXBProvider.java (1 line):
	- line 718: //TODO: move these methods into the dedicated utility class


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMManager.java (1 line):
	- line 439: // TODO: better error handling


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMOutInterceptor.java (1 line):
	- line 212: // TODO:


rt/ws/addr/src/main/java/org/apache/cxf/ws/addressing/impl/InternalContextUtils.java (1 line):
	- line 179: //TODO:Look at how to refactor


services/xkms/xkms-x509-handlers/src/main/java/org/apache/cxf/xkms/x509/validator/DateValidator.java (1 line):
	- line 56: * TODO: clarify use of KeyUsage with customer if (null == certificate.getKeyUsage()) { return false; }


rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSStaxTokenValidator.java (1 line):
	- line 74: * TODO Refactor this class a bit better...


tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/processor/internal/ServiceProcessor.java (1 line):
	- line 370: // TODO: add customize here


services/xkms/xkms-x509-handlers/src/main/java/org/apache/cxf/xkms/x509/handlers/X509Register.java (1 line):
	- line 83: //TODO standard requires support for multiple useKeyWith attributes


rt/transports/websocket/src/main/java/org/apache/cxf/transport/websocket/jetty/WebSocketVirtualServletRequest.java (1 line):
	- line 416: //TODO remove the query string part


rt/rs/client/src/main/java/org/apache/cxf/jaxrs/client/WebClient.java (1 line):
	- line 1048: //TODO: retry invocation will not work in case of async request failures for the moment


core/src/main/java/org/apache/cxf/bus/spring/SpringBus.java (1 line):
	- line 134: //TODO:[OSGi+Jakarta] uncomment this when osgi comes back


rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AccessTokenValidatorService.java (1 line):
	- line 67: //TODO: check client certificates


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsJsonOutputStream.java (1 line):
	- line 58: //TODO: Review if it is at least theoretically possible that a given b[] region


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/SourceSequence.java (1 line):
	- line 38: // TODO: handle lastMessage


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/JAXRSUtils.java (1 line):
	- line 1435: //TODO : multiple query string parsing, do it once


rt/transports/http-netty/netty-server/src/main/java/org/apache/cxf/transport/http/netty/server/servlet/NettyServletResponse.java (1 line):
	- line 76: //TODO Do we need to implement it ?


rt/javascript/javascript-rt/src/main/java/org/apache/cxf/javascript/ParticleInfo.java (1 line):
	- line 279: // TODO: multiple 'any'


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/soap/RetransmissionQueueImpl.java (1 line):
	- line 576: //TODO release the message and later reload it upon resume


maven-plugins/wadl2java-plugin/src/main/java/org/apache/cxf/maven_plugin/common/ForkOnceCodeGenerator.java (1 line):
	- line 29: //TODO: Move to the common plugin module


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/impl/ContainerRequestContextImpl.java (1 line):
	- line 135: // TODO: The JAX-RS TCK requires the full uri toString() rather than just the raw path, but


rt/transports/http-jetty/src/main/java/org/apache/cxf/transport/http_jetty/JettyHTTPServerEngineFactory.java (1 line):
	- line 325: // TODO Auto-generated catch block


integration/jca/src/main/java/org/apache/cxf/jca/cxf/ManagedConnectionImpl.java (1 line):
	- line 230: //TODO should throw the exception


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/BinaryDataProvider.java (1 line):
	- line 137: // TODO: if it's a range request, then we should probably always return -1 and set


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/ExceptionUtils.java (1 line):
	- line 107: //TODO: we can simply use the reflection, investigate


rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/QueryContextProvider.java (1 line):
	- line 81: //TODO: consider introducing SearchConditionVisitor.getBeanClass &&


rt/transports/http-hc/src/main/java/org/apache/cxf/transport/http/asyncclient/AsyncHTTPConduit.java (1 line):
	- line 583: // TODO Auto-generated catch block


rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlSigOutInterceptor.java (1 line):
	- line 49: //TODO: Make sure that enveloped signatures can be applied to individual


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMInInterceptor.java (1 line):
	- line 80: //TODO look at how we can refactor all these decoupled faultTo stuff


rt/transports/websocket/src/main/java/org/apache/cxf/transport/websocket/jetty12/Jetty12WebSocketDestination.java (1 line):
	- line 220: // TODO Auto-generated catch block


rt/transports/http/src/main/java/org/apache/cxf/transport/http/MessageTrustDecider.java (1 line):
	- line 92: * TODO: What are the existing Message Properties at the point of this call?


rt/databinding/jaxb/src/main/java/org/apache/cxf/jaxb/JAXBSchemaInitializer.java (1 line):
	- line 496: //TODO: handle @XmlAccessOrder


rt/wsdl/src/main/java/org/apache/cxf/wsdl/interceptors/DocLiteralInInterceptor.java (1 line):
	- line 308: //TODO - should check minOccurs=0 and throw validation exception


rt/transports/http/src/main/java/org/apache/cxf/transport/https/httpclient/DefaultHostnameVerifier.java (1 line):
	- line 300: // TODO ASN.1 DER encoded form


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java (1 line):
	- line 76: * TODO documentation for these


rt/bindings/coloc/src/main/java/org/apache/cxf/binding/coloc/ColocInInterceptor.java (1 line):
	- line 58: //TODO Set Coloc FaultObserver chain


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/impl/RequestImpl.java (1 line):
	- line 46: * TODO : deal with InvalidStateExceptions


services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/ClaimUtils.java (1 line):
	- line 230: // First match TODO refactor for better method override


tools/wadlto/jaxrs/src/main/java/org/apache/cxf/tools/wadlto/jaxrs/JAXRSContainer.java (1 line):
	- line 244: //TODO: this belongs to JAXB Databinding, should we just reuse


rt/transports/http/src/main/java/org/apache/cxf/transport/https/SSLUtils.java (1 line):
	- line 112: // TODO do we need to cache the context


tools/corba/src/main/java/org/apache/cxf/tools/corba/idlpreprocessor/IdlPreprocessorReader.java (1 line):
	- line 222: * TODO: support multiline definitions, functions, etc.


rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/AbstractTypeCreator.java (1 line):
	- line 321: // TODO: Get namespace from XML?


rt/javascript/javascript-rt/src/main/java/org/apache/cxf/javascript/types/SchemaJavascriptBuilder.java (1 line):
	- line 519: // TODO: for simple types we really need a dictionary of the simple type qnames.


rt/bindings/coloc/src/main/java/org/apache/cxf/binding/coloc/ColocOutInterceptor.java (1 line):
	- line 144: //TODO a Context Filter Strategy required.


tools/wsdlto/core/src/main/java/org/apache/cxf/tools/wsdlto/WSDLToJavaContainer.java (1 line):
	- line 226: // TODO: wsdl2.0 support


core/src/main/java/org/apache/cxf/endpoint/ClientImpl.java (1 line):
	- line 564: * TODO This is SOAP specific code and should not be in cxf core


rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/state/SPStateManager.java (1 line):
	- line 27: * TODO: review the possibility of working with the Servlet HTTPSession


tools/wsdlto/frontend/javascript/src/main/java/org/apache/cxf/tools/wsdlto/javascript/JavaScriptContainer.java (1 line):
	- line 128: // TODO: wsdl2.0 support


rt/transports/http/src/main/java/org/apache/cxf/transport/https/HttpsURLConnectionInfo.java (1 line):
	- line 113: //TODO Obtain localPrincipal and peerPrincipal using the com.sun.net.ssl api


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/JAXBElementProvider.java (1 line):
	- line 549: // TODO: there has to be a better fix


maven-plugins/wadl2java-plugin/src/main/java/org/apache/cxf/maven_plugin/common/DocumentArtifact.java (1 line):
	- line 25: //TODO: Move to the common plugin module


tools/validator/src/main/java/org/apache/cxf/tools/validator/internal/WSIBPValidator.java (1 line):
	- line 407: // TODO: Should also check SoapHeader/SoapHeaderFault


rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractStaxBindingHandler.java (1 line):
	- line 662: /* TODO else if (isRequestor()


rt/rs/client/src/main/java/org/apache/cxf/jaxrs/client/AbstractClient.java (1 line):
	- line 777: // TODO: if failover conduit selector fails to find a failover target


integration/jca/src/main/java/org/apache/cxf/jca/inbound/MDBActivationSpec.java (1 line):
	- line 192: * TODO implement validation


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/Proxy.java (1 line):
	- line 133: // TODO: need to set relatesTo


rt/bindings/coloc/src/main/java/org/apache/cxf/binding/coloc/ColocMessageObserver.java (1 line):
	- line 79: //TODO a Context Filter Strategy required.


rt/rs/extensions/rx/src/main/java/org/apache/cxf/jaxrs/rx/server/ObservableInvoker.java (1 line):
	- line 38: //TODO: if it is a Cancelation exception => asyncResponse.cancel();


rt/ws/policy/src/main/java/org/apache/cxf/ws/policy/WSPolicyFeature.java (1 line):
	- line 180: // FIXME - ideally this should probably be moved up to where the policies are applied to the


rt/wsdl/src/main/java/org/apache/cxf/wsdl11/WSDLServiceFactory.java (1 line):
	- line 119: //@@TODO  - this isn't good, need to return all the services


rt/transports/websocket/src/main/java/org/apache/cxf/transport/websocket/ahc/AhcWebSocketConduitRequest.java (1 line):
	- line 25: * TODO may rename it to WebSocketConduitRequest and move it to a generic package


rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwa/ContentAlgorithm.java (1 line):
	- line 29: //TODO: default to "AES/CBC/PKCS5Padding" if Cipher "AES/CBC/PKCS7Padding"


rt/transports/jms/src/main/java/org/apache/cxf/transport/jms/uri/JMSEndpointWSDLUtil.java (1 line):
	- line 46: // TODO We could have more than one parameter


rt/transports/http-netty/netty-server/src/main/java/org/apache/cxf/transport/http/netty/server/servlet/NettyHttpSession.java (1 line):
	- line 81: // TODO do we need to support this


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/MultipartProvider.java (1 line):
	- line 471: // TODO : throw UnsupportedOperationException for all other DataHandler methods


rt/databinding/jaxb/src/main/java/org/apache/cxf/jaxb/io/DataReaderImpl.java (1 line):
	- line 150: // TODO:Cache the JAXBRIContext


rt/rs/security/oauth-parent/oauth2-saml/src/main/java/org/apache/cxf/rs/security/oauth2/saml/SamlOAuthValidator.java (1 line):
	- line 166: //TODO: replay cache, same as with SAML SSO case


rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/common/AccessTokenValidation.java (1 line):
	- line 41: //TODO: consider simply extending ServerAccessToken,


rt/transports/http-netty/netty-server/src/main/java/org/apache/cxf/transport/http/netty/server/NettyHttpServerEngineFactory.java (1 line):
	- line 218: // TODO Auto-generated catch block


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/impl/UriBuilderImpl.java (1 line):
	- line 203: // TODO: the bogus case of segments containing encoded '/'


rt/transports/http/src/main/java/org/apache/cxf/transport/https/httpclient/InetAddressUtils.java (1 line):
	- line 46: private static final Pattern IPV4_MAPPED_IPV6_PATTERN = // TODO does not allow for redundant leading zeros


tools/corba/src/main/java/org/apache/cxf/tools/corba/processors/idl/ObjectReferenceVisitor.java (1 line):
	- line 283: // TODO: This is correct but the appinfo markup is never added to the


rt/rs/extensions/rx/src/main/java/org/apache/cxf/jaxrs/rx/client/ObservableRxInvokerProvider.java (1 line):
	- line 33: // TODO: At the moment we still delegate if possible to the async HTTP conduit.


rt/frontend/simple/src/main/java/org/apache/cxf/frontend/WSDLGetInterceptor.java (1 line):
	- line 104: // TODO - how can I improve this to provide a specific interceptor chain that just has the


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/provider/ServerProviderFactory.java (1 line):
	- line 261: //TODO: review the possibility of DynamicFeatures needing to have Contexts injected


rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/ext/ProtocolHeadersImpl.java (1 line):
	- line 29: // TODO : introduce a common abstract class instead with


rt/rs/extensions/search/src/main/java/org/apache/cxf/jaxrs/ext/search/SearchUtils.java (1 line):
	- line 176: // TODO : if we have the same column involved, ex a >= 123 and a <=244 then


services/sts/sts-core/src/main/java/org/apache/cxf/sts/claims/mapper/JexlClaimsMapper.java (1 line):
	- line 84: return new ProcessedClaimCollection(); // TODO Check if null or an exception would be more


rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/authorization/SecurityContextProviderImpl.java (1 line):
	- line 98: //TODO: This can be overridden, but consider also introducing dedicated handlers


rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JoseSessionTokenProvider.java (1 line):
	- line 182: //TODO: make it simpler, convert it to JwtClaims -> JSON


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/spring/RMManagerBeanDefinitionParser.java (1 line):
	- line 50: // TODO: handle


tools/corba/src/main/java/org/apache/cxf/tools/corba/processors/idl/TypeDclVisitor.java (1 line):
	- line 78: // TODO forward declaration <constr_forward_declaration>


maven-plugins/wadl2java-plugin/src/main/java/org/apache/cxf/maven_plugin/common/ClassLoaderSwitcher.java (1 line):
	- line 43: // TODO: Move to the common plugin module


rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/OidcDynamicRegistrationService.java (1 line):
	- line 60: // TODO: may need to be 384/8 or 512/8 if not a default HS256 but HS384 or HS512


tools/corba/src/main/java/org/apache/cxf/tools/corba/processors/idl/IDLToWSDLProcessor.java (1 line):
	- line 570: // TODO: REVISIT - Is this the only way we can create the file name for the


rt/rs/security/oauth-parent/oauth2-saml/src/main/java/org/apache/cxf/rs/security/oauth2/auth/saml/Saml2BearerAuthHandler.java (1 line):
	- line 122: //TODO:  Attempt to map client_id to subject.getName()


rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/databinding/ElementDataReader.java (1 line):
	- line 73: // TODO: pay attention to the typeClass parameter.


rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/persistence/RMMessage.java (1 line):
	- line 30: //TODO remove attachments when we remove the deprecated attachments related methods


rt/transports/http-netty/netty-server/src/main/java/org/apache/cxf/transport/http/netty/server/servlet/HttpSessionThreadLocal.java (1 line):
	- line 60: // TODO need to set the sessionTimeout