contao/core — comment on commit f243a4f6e46989c72e00c753a61c9593dd6ab0f0
File: system/modules/frontend/models/PageModel.php line 219
By aschempp:

I see a big security risk in this, because you are passing the aliases directly to the database query?