Merge branch '7.0.x'

# Conflicts:
#	spring-context/src/main/java/org/springframework/validation/DataBinder.java

spring-web/src/main/java/org/springframework/web/bind/support/ConfigurableWebBindingInitializer.java

@@ -83,6 +83,8 @@ public class ConfigurableWebBindingInitializer implements WebBindingInitializer
 	 * Set whether to use direct field access instead of bean property access.
 	 * <p>Default is {@code false}, using bean property access.
 	 * Switch this to {@code true} in order to enforce direct field access.
+	 * <p><b>NOTE: This is an advanced option for trusted scenarios.</b>
+	 * Do not use direct field access for data binding from untrusted sources.
 	 * @see org.springframework.validation.DataBinder#initDirectFieldAccess()
 	 * @see org.springframework.validation.DataBinder#initBeanPropertyAccess()
 	 */

spring-web/src/main/java/org/springframework/web/util/HtmlCharacterEntityDecoder.java

@@ -124,7 +124,7 @@ class HtmlCharacterEntityDecoder {
 			int value = (!isHexNumberedReference ?
 					Integer.parseInt(getReferenceSubstring(2)) :
 					Integer.parseInt(getReferenceSubstring(3), 16));
-			if (value > Character.MAX_CODE_POINT) {
+			if (value < 0 || value > Character.MAX_CODE_POINT) {
 				return false;
 			}
 			this.decodedMessage.appendCodePoint(value);