As default, `criteriaQuery` should be escaped to prevent XSS.