From 864c94f490596b96d4bbc560f6085c3531da1d16 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Tue, 14 Jun 2022 09:11:46 +0200 Subject: [PATCH] Wrap SpEL documentation with admonition. Closes #4085 --- src/main/asciidoc/reference/mongo-repositories.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/asciidoc/reference/mongo-repositories.adoc b/src/main/asciidoc/reference/mongo-repositories.adoc index 67dc4bc56..804ec31c7 100644 --- a/src/main/asciidoc/reference/mongo-repositories.adoc +++ b/src/main/asciidoc/reference/mongo-repositories.adoc @@ -501,9 +501,9 @@ public interface PersonRepository extends MongoRepository { } ---- -SpEL in query strings can be a powerful way to enhance queries. +WARNING: SpEL in query strings can be a powerful way to enhance queries. However, they can also accept a broad range of unwanted arguments. -You should make sure to sanitize strings before passing them to the query to avoid unwanted changes to your query. +Make sure to sanitize strings before passing them to the query to avoid creation of vulnerabilities or unwanted changes to your query. Expression support is extensible through the Query SPI: `org.springframework.data.repository.query.spi.EvaluationContextExtension`. The Query SPI can contribute properties and functions and can customize the root object.