Our JPQL query has concat('%', ?1) and Hibernate on the attempt of logging the query details fails on String.format:
User input should never be used as format expression, only as format argument - to avoid interpretation of some sequences as magical. The culprit is here:
|