我有一个Springboot应用程序，它使用Spring Data JPA模块进行数据库操作。当我们扫描代码时，checkmarx报告了许多关于SQL_Injection攻击的高和中等级别的问题。以下是其中一个用例，我需要帮助来确定是否将问题标记为误报。如果不是误报，我应该做什么来修复问题。

应用程序控制器.Java

@Controller
public class AppController
{
    private static final Logger logger = LoggerFactory.getLogger(AppController.class);

    @Autowired
    private AppService appService;

    @RequestMapping(value = "/propertiesHistory", method = RequestMethod.POST)
    public String getPropertiesHistory(@ModelAttribute("propSearchForm") @Validated PropertiesSearch propertiesSearch, BindingResult result, Model model, final RedirectAttributes redirectAttributes)
    {
        String instanceName = propertiesSearch.getInstanceName();

        if (!propertiesSearch.getInstanceName().equalsIgnoreCase("NONE"))
        {
            List<String> propVersionDates = appService.getPropertyHistoryDates(instanceName);
            //Some Businees Logic
        }

        if (result.hasErrors())
        {
            logger.warn("getPropertiesHistory() : Binding error - " + result.getAllErrors());
        }
        else
        {
            //Some Businees Logic
        }
        return "app/prophist";
    }
}

应用程序服务.java

@Service
public class AppService
{
    private static final Logger logger = LoggerFactory.getLogger(AppService.class);

    @Autowired
    private AppRepository appRepository;

    public List<String> getPropertyHistoryDates(String instanceName)
    {
        List<String> list = new ArrayList<String>();
        try
        {
            list = appRepository.findAllMDateDESCByProNotEmptyAndInstanceName(instanceName);
        }
        catch (Exception e)
        {
            logger.error("getPropertyHistoryDates(): Error while fetching data from database - ", e);
        }

        return list;
    }
}

应用程序存储库.java

public interface AppRepository extends JpaRepository<AppDataEntity, Long>
{
    @Query(value="SELECT mdate FROM tablexyz WHERE properties IS NOT NULL AND instanceName =:instanceName ORDER BY mdate DESC",nativeQuery=true)
    List<String> findAllMDateDESCByProNotEmptyAndInstanceName(@Param("instanceName") String instanceName);
}

我也有一些方法，比如仓库中的List<AppDataEntity> findAllByInstanceName(String instanceName);，它使用代理类实现，但不使用本地查询。在这种情况下，我也会遇到Checkmarx问题- SQL_Injection。
我读到Spring Data 不会改变Hibernate处理实体的方式，这是公认的答案here。这是真的吗？是否适用于@Query(value="some query",nativeQuery=true)？