From 0ebaec6908196071b6709b48dbce83825a740129 Mon Sep 17 00:00:00 2001
From: Michael Hoennig <michael@hoennig.de>
Date: Fri, 13 Dec 2024 10:09:58 +0100
Subject: [PATCH] =?UTF-8?q?TODO=20f=C3=BCr=20potentielle=20SQL-Injection?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../hs/office/contact/HsOfficeContactRbacRepository.java         | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactRbacRepository.java b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactRbacRepository.java
index 924f3277..ec2b15d1 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactRbacRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactRbacRepository.java
@@ -35,6 +35,7 @@ public interface HsOfficeContactRbacRepository extends Repository<HsOfficeContac
     }
 
     static String emailRegEx(@NotNull String emailAddress) {
+        // TODO.impl: find more secure solution, maybe we substitute a placeholder with the whole expression?
         if (emailAddress.contains("'") || emailAddress.endsWith("\\") ) {
             throw new ValidationException(
                     "emailAddress contains invalid characters: " + emailAddress);