From e3ec68b07c7d688ec600f8c3740c7252c773f506 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Tue, 14 Jun 2022 09:11:46 +0200 Subject: [PATCH] Wrap SpEL documentation with admonition. Closes #4085 --- src/main/asciidoc/reference/mongo-repositories.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/asciidoc/reference/mongo-repositories.adoc b/src/main/asciidoc/reference/mongo-repositories.adoc index b9032e309..b4c2d8b48 100644 --- a/src/main/asciidoc/reference/mongo-repositories.adoc +++ b/src/main/asciidoc/reference/mongo-repositories.adoc @@ -548,9 +548,9 @@ public interface PersonRepository extends MongoRepository { } ---- -SpEL in query strings can be a powerful way to enhance queries. +WARNING: SpEL in query strings can be a powerful way to enhance queries. However, they can also accept a broad range of unwanted arguments. -You should make sure to sanitize strings before passing them to the query to avoid unwanted changes to your query. +Make sure to sanitize strings before passing them to the query to avoid creation of vulnerabilities or unwanted changes to your query. Expression support is extensible through the Query SPI: `org.springframework.data.repository.query.spi.EvaluationContextExtension`. The Query SPI can contribute properties and functions and can customize the root object.