[filiphr]

The management/tables REST resources expose raw database table content and are the entry point for the order column SQL injection reported in #4260 (also finding 3 in #4272). This PR makes them opt-in.

Changes

Flag for the table resources

• New property flowable.rest.table-management.enabled (default false).
• When disabled, TableCollectionResource, TableResource, TableColumnsResource and TableDataResource are not registered, so requests to management/tables/** return 404.
• The property is read from the Spring Environment, so it works with Spring Boot (including relaxed binding / FLOWABLE_REST_TABLE_MANAGEMENT_ENABLED) as well as plain Spring (@PropertySource, system properties).
• A warning is logged at startup when the resources are enabled.
• Added to the Spring Boot configuration metadata, flowable-default.properties of the REST app, and the REST docs.

Spring MVC exceptions in the REST error handling

• Previously, Spring MVC exceptions (no handler found, method not supported, missing request parameter, etc.) fell through to the generic handler and were returned as 500 and logged as errors.
• BaseExceptionHandlerAdvice now uses the status and headers of Spring's ErrorResponse:
  • 4xx: logged at debug, message is the problem title and exception is the problem detail (the detail is client facing, the exception message can contain internals such as controller method signatures).
  • 5xx: same handling as other unhandled exceptions (error log with stack trace, error ID when sendFullErrorException is false), but with Spring's status.
• This is what makes the disabled table resources return a proper 404 instead of a 500.

Upgrade notes

• Applications using the management/tables REST resources need to set flowable.rest.table-management.enabled=true.
• REST clients that relied on 500 for Spring MVC errors (e.g. unknown endpoints, unsupported methods) now get the actual 4xx status.

Related to #4260 and #4272. Enabling the flag still exposes the unvalidated order column, so validating it remains a follow-up.