Spring Data JPA PageRequest order by Map value property

Question

Simplified version of my problem: Suppose there are two entities, Fish and Chip.

Fish has a one-to-many relation to Chip modeled as a Map:

public class Fish {

    @OneToMany
    @JoinTable(name = "the_map",
            joinColumns = @JoinColumn(name = "fish_id"),
            inverseJoinColumns = @JoinColumn(name = "chip_id")
    )
    @MapKeyColumn(name = "the_key")
    private Map<Integer, Chip> chipsMap;
}

The following HQL-Query produces valid SQL:

from Fish order by chipsMap[2].createDate

Trying the same with Spring Data

PageRequest pr = new PageRequest(0, 10, 
    Sort.Direction.ASC.fromString("chipsMap[2].createDate"));

fishRepository.findAll(pr);

throws

org.springframework.data.mapping.PropertyReferenceException:
    No property chipsMap[2] found for type Fish!

Problem in Spring Data JPA? Or wrong syntax?

Answer 1

As documented here, Sort needs a safe expression as it could potentially use unexposed properties and thus become a security problem. See this CVE for details.

If you know what you're doing and not using potentially malicious end user sort phrases, you can use JpaSort.unsafe(…).