Collected research

Improper Spring @Query Usage Allows N1QL Injection

pavel · Gremwell

Compares Spring Data Couchbase queries that bind parameters with annotations that interpolate untrusted input through SpEL. A diagnostic quote reveals the generated N1QL statement, and a Spring test application plus a request-body repair for N1QLMap demonstrates the difference between safe binding and injectable query construction.

Record

Researcher

pavel

Published by

Gremwell

Topic

Injection

In the archive

• Collected in the 2021 research round

Related sources

• Spring Data Couchbase injection report
• Spring N1QL demonstration application

Tags

• spring
• nosqli
• database
• injection
• tooling
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of pavel, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.