Merge branch '2.0.x'

spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc

@@ -2352,15 +2352,23 @@ suffix pattern matching, the following configuration is required:
 [source,properties,indent=0,subs="verbatim,quotes,attributes"]
 ----
 	spring.mvc.contentnegotiation.favor-path-extension=true
+	spring.mvc.pathmatch.use-suffix-pattern=true
+----
 
-	# You can also restrict that feature to known extensions only
-	# spring.mvc.pathmatch.use-registered-suffix-pattern=true
+Alternatively, rather than open all suffix patterns, it's more secure to just support
+registered suffix patterns:
 
-	# We can also register additional file extensions/media types with:
+[source,properties,indent=0,subs="verbatim,quotes,attributes"]
+----
+	spring.mvc.contentnegotiation.favor-path-extension=true
+	spring.mvc.pathmatch.use-registered-suffix-pattern=true
+
+	# You can also register additional file extensions/media types with:
 	# spring.mvc.contentnegotiation.media-types.adoc=text/asciidoc
 ----
 
 
+
 [[boot-features-spring-mvc-web-binding-initializer]]
 ==== ConfigurableWebBindingInitializer
 Spring MVC uses a `WebBindingInitializer` to initialize a `WebDataBinder` for a