Allow configuration of QueryEngine for Map repositories

[smurf667]

Hello, our code started to fail with UncategorizedKeyValueException after upgrading to Spring Boot 3.3.0:

Exception in thread "main" org.springframework.data.keyvalue.core.UncategorizedKeyValueException: class java.lang.String cannot be cast to class java.util.function.Predicate (java.lang.String and java.util.function.Predicate are in module java.base of loader 'bootstrap')

It turns out that the SpelQueryEngine is no longer used by default (despite the documentation saying so according to my reading). Also, I don't know how to configure this engine.

I have an example project at https://github.com/smurf667/demo-keyvalue which demonstrates the issue. Run mvn spring-boot:run to see the exception. Uncomment the older version 3.2.6 to make this work.

[mp911de]

We intentionally switched to a Predicate-based query engine to avoid exploitation through SpEL. You can switch back to the SpEL query engine by utilizing a bit of reflection:

@Bean
KeyValueTemplate mapKeyValueTemplate() throws ReflectiveOperationException {

    Class<QueryEngine<? extends KeyValueAdapter, ?, ?>> spelQueryEngineClass = (Class) Class.forName("org.springframework.data.keyvalue.core.SpelQueryEngine");
    MapKeyValueAdapter adapter = new MapKeyValueAdapter(BeanUtils.instantiateClass(spelQueryEngineClass));

    return new KeyValueTemplate(adapter);
}

With the switch, we missed to update the documentation.

[smurf667]

Thank you Mark. Speaking for us, we won't be using reflection and will switch our code so it uses the Predicate-based query engine, also to avoid any trouble with potential SpEL exploitation. If that engine should not be used, maybe deprecate and later remove it? If it may be used, then I suppose a better way than reflection ought to be possible, but that's just my opinion.

Thanks, feel free to close this issue, or use it as the vehicle to update the documentation.

[mp911de]

I'm going to take the issue to the team. We might make the query engines public classes to offer some choice. Also, we need to consider how one would configure query engines.

SpEL isn't a bad choice, it is more that a Predicate-based approach is much safer for the default case in which we don't know whether queries can be supplied from untrusted sources.

[mp911de]

We are going to introduce means for configuring the Query Engine, likely through an QueryEngineFactory abstraction that can be configured through @EnableMapRepositories.