GitHub Security Lab: CodeQL query for SpEL injections

This bug was reported directly to GitHub Security Lab...