#164 - Support @query definitions with SpEL expressions.

We now support SpEL expressions in string-based queries to bind parameters for more dynamic queries. SpEL expressions are enclosed in :#{…} and rendered as synthetic named parameter so their values are substituted with bound parameters to avoid SQL injection attach vectors.

interface PersonRepository extends Repository<Person, String> {

	@query("SELECT * FROM person WHERE lastname = :#{'hello'}")
	Mono<Person> findHello();

	@query("SELECT * FROM person WHERE lastname = :#{[0]} and firstname = :firstname")
	Mono<Person> findByLastnameAndFirstname(@param("value") String value, @param("firstname") String firstname);

	@query("SELECT * FROM person WHERE lastname = :#{#person.name}")
	Mono<Person> findByExample(@param("person") Person person);
}

Author: mp911de

Diff for: src/main/asciidoc/new-features.adoc

@@ -14,6 +14,7 @@
 * `@Modifying` annotation for query methods to consume affected row count.
 * Repository `save(…)` with an associated Id terminates with `TransientDataAccessException` if the row does not exist in the database.
 * Added `SingleConnectionConnectionFactory` for testing using connection singletons.
+* Support for {spring-framework-ref}/core.html#expressions[SpEL expressions] in `@Query`.
 
 [[new-features.1-0-0-RC1]]
 == What's New in Spring Data R2DBC 1.0.0 RC1

Diff for: src/main/asciidoc/reference/r2dbc-repositories.adoc

@@ -149,6 +149,35 @@ The result of a modifying query can be:
 The `@Modifying` annotation is only relevant in combination with the `@Query` annotation.
 Derived custom methods do not require this annotation.
 
+[[r2dbc.repositories.queries.spel]]
+=== Queries with SpEL Expressions
+
+Query string definitions can be used together with SpEL expressions to create dynamic queries at runtime.
+SpEL expressions can provide predicate values which are evaluated right before executing the query.
+
+Expressions expose method arguments through an array that contains all the arguments.
+The following query uses `[0]`
+to declare the predicate value for `lastname` (which is equivalent to the `:lastname` parameter binding):
+
+[source,java]
+----
+public interface PersonRepository extends ReactiveCrudRepository<Person, String> {
+
+  @Query("SELECT * FROM person WHERE lastname = :#{[0]} }")
+  List<Person> findByQueryWithExpression(String lastname);
+}
+----
+
+SpEL in query strings can be a powerful way to enhance queries.
+However, they can also accept a broad range of unwanted arguments.
+You should make sure to sanitize strings before passing them to the query to avoid unwanted changes to your query.
+
+Expression support is extensible through the Query SPI: `org.springframework.data.spel.spi.EvaluationContextExtension`.
+The Query SPI can contribute properties and functions and can customize the root object.
+Extensions are retrieved from the application context at the time of SpEL evaluation when the query is built.
+
+TIP: When using SpEL expressions in combination with plain parameters, use named parameter notation instead of native bind markers to ensure a proper binding order.
+
 [[r2dbc.entity-persistence.state-detection-strategies]]
 === Entity State Detection Strategies
 

Diff for: src/main/java/org/springframework/data/r2dbc/repository/query/ExpressionEvaluatingParameterBinder.java

@@ -0,0 +1,194 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.data.r2dbc.repository.query;
+
+import static org.springframework.data.r2dbc.repository.query.ExpressionQuery.*;
+
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
+
+import org.springframework.data.r2dbc.core.DatabaseClient;
+import org.springframework.data.r2dbc.mapping.SettableValue;
+import org.springframework.data.relational.repository.query.RelationalParameterAccessor;
+import org.springframework.data.repository.query.Parameter;
+import org.springframework.data.repository.query.Parameters;
+import org.springframework.data.repository.query.QueryMethodEvaluationContextProvider;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.util.Assert;
+
+/**
+ * {@link ExpressionEvaluatingParameterBinder} allows to evaluate, convert and bind parameters to placeholders within a
+ * {@link String}.
+ *
+ * @author Mark Paluch
+ * @since 1.1
+ */
+class ExpressionEvaluatingParameterBinder {
+
+	private final SpelExpressionParser expressionParser;
+
+	private final QueryMethodEvaluationContextProvider evaluationContextProvider;
+
+	private final ExpressionQuery expressionQuery;
+
+	private final Map<String, Boolean> namedParameters = new ConcurrentHashMap<>();
+
+	/**
+	 * Creates new {@link ExpressionEvaluatingParameterBinder}
+	 *
+	 * @param expressionParser must not be {@literal null}.
+	 * @param evaluationContextProvider must not be {@literal null}.
+	 * @param expressionQuery must not be {@literal null}.
+	 */
+	ExpressionEvaluatingParameterBinder(SpelExpressionParser expressionParser,
+			QueryMethodEvaluationContextProvider evaluationContextProvider, ExpressionQuery expressionQuery) {
+
+		Assert.notNull(expressionParser, "ExpressionParser must not be null");
+		Assert.notNull(evaluationContextProvider, "EvaluationContextProvider must not be null");
+		Assert.notNull(expressionQuery, "ExpressionQuery must not be null");
+
+		this.expressionParser = expressionParser;
+		this.evaluationContextProvider = evaluationContextProvider;
+		this.expressionQuery = expressionQuery;
+	}
+
+	/**
+	 * Bind values provided by {@link RelationalParameterAccessor} to placeholders in {@link ExpressionQuery} while
+	 * considering potential conversions and parameter types.
+	 *
+	 * @param bindSpec must not be {@literal null}.
+	 * @param parameterAccessor must not be {@literal null}.
+	 */
+	public <T extends DatabaseClient.BindSpec<T>> T bind(T bindSpec, RelationalParameterAccessor parameterAccessor) {
+
+		Object[] values = parameterAccessor.getValues();
+		Parameters<?, ?> bindableParameters = parameterAccessor.getBindableParameters();
+
+		T bindSpecToUse = bindExpressions(bindSpec, values, bindableParameters);
+		bindSpecToUse = bindParameters(bindSpecToUse, parameterAccessor.hasBindableNullValue(), values, bindableParameters);
+
+		return bindSpecToUse;
+	}
+
+	private <T extends DatabaseClient.BindSpec<T>> T bindExpressions(T bindSpec, Object[] values,
+			Parameters<?, ?> bindableParameters) {
+
+		T bindSpecToUse = bindSpec;
+
+		for (ParameterBinding binding : expressionQuery.getBindings()) {
+
+			SettableValue valueForBinding = getParameterValueForBinding(bindableParameters, values, binding);
+
+			if (valueForBinding.isEmpty()) {
+				bindSpecToUse = bindSpecToUse.bindNull(binding.getParameterName(), valueForBinding.getType());
+			} else {
+				bindSpecToUse = bindSpecToUse.bind(binding.getParameterName(), valueForBinding.getValue());
+			}
+		}
+
+		return bindSpecToUse;
+	}
+
+	private <T extends DatabaseClient.BindSpec<T>> T bindParameters(T bindSpec, boolean bindableNull, Object[] values,
+			Parameters<?, ?> bindableParameters) {
+
+		T bindSpecToUse = bindSpec;
+		int index = 0;
+		int bindingIndex = 0;
+
+		for (Object value : values) {
+
+			Parameter bindableParameter = bindableParameters.getBindableParameter(index++);
+
+			Optional<String> name = bindableParameter.getName();
+
+			if ((name.isPresent() && isNamedParameterUsed(name)) || !expressionQuery.getBindings().isEmpty()) {
+
+				if (isNamedParameterUsed(name)) {
+
+					if (value == null) {
+						if (bindableNull) {
+							bindSpecToUse = bindSpecToUse.bindNull(name.get(), bindableParameter.getType());
+						}
+					} else {
+						bindSpecToUse = bindSpecToUse.bind(name.get(), value);
+					}
+				}
+
+				// skip unused named parameters if there is SpEL
+			} else {
+				if (value == null) {
+					if (bindableNull) {
+						bindSpecToUse = bindSpecToUse.bindNull(bindingIndex++, bindableParameter.getType());
+					}
+				} else {
+					bindSpecToUse = bindSpecToUse.bind(bindingIndex++, value);
+				}
+			}
+		}
+
+		return bindSpecToUse;
+	}
+
+	private boolean isNamedParameterUsed(Optional<String> name) {
+
+		if (!name.isPresent()) {
+			return false;
+		}
+
+		return namedParameters.computeIfAbsent(name.get(), it -> {
+
+			Pattern namedParameterPattern = Pattern.compile("(\\W)[:#$@]" + Pattern.quote(it) + "(\\W|$)");
+			return namedParameterPattern.matcher(expressionQuery.getQuery()).find();
+		});
+	}
+
+	/**
+	 * Returns the value to be used for the given {@link ParameterBinding}.
+	 *
+	 * @param parameters must not be {@literal null}.
+	 * @param binding must not be {@literal null}.
+	 * @return the value used for the given {@link ParameterBinding}.
+	 */
+	private SettableValue getParameterValueForBinding(Parameters<?, ?> parameters, Object[] values,
+			ParameterBinding binding) {
+		return evaluateExpression(binding.getExpression(), parameters, values);
+	}
+
+	/**
+	 * Evaluates the given {@code expressionString}.
+	 *
+	 * @param expressionString must not be {@literal null} or empty.
+	 * @param parameters must not be {@literal null}.
+	 * @param parameterValues must not be {@literal null}.
+	 * @return the value of the {@code expressionString} evaluation.
+	 */
+	private SettableValue evaluateExpression(String expressionString, Parameters<?, ?> parameters,
+			Object[] parameterValues) {
+
+		EvaluationContext evaluationContext = evaluationContextProvider.getEvaluationContext(parameters, parameterValues);
+		Expression expression = expressionParser.parseExpression(expressionString);
+
+		Object value = expression.getValue(evaluationContext, Object.class);
+		Class<?> valueType = expression.getValueType(evaluationContext);
+
+		return SettableValue.fromOrEmpty(value, valueType != null ? valueType : Object.class);
+	}
+}