...

JQL in JSU can be very powerful. However you also must think very careful, what values might be used as replacement for the {issue.FIELD NAME} placeholders. Or what happens, if an issue has no value on such a field. There could be quite some variety in the data of your issues.

 If you are not careful, the result of such a JQL query unexpectedly might contain thousands of issue. Or the JQL query might fail, because the syntax has become invalid after the placeholders had been replaced.

...

By default this limit is 50. You cannot set any higher limit than 1000.

JQL Injection

 Further you must be aware of potential 'JQL injection':
JSU does not check any value which it retrieves from the current issue. A malicious user might craft the value of a field (for example the value of a text field), so that after the replacement it adds an additional criteria to your JQL query.

 We recommend not to use any text fields as placeholders. Or any other field, of which the user can freely change the text. Only use fields which can contain one/several of clearly defined values.

Syntax for Keys of the current Issue

Key of the JQL should be same as Key in the Advance Search. You can use issue navigator to write correct key.

System Fields

System Fields names should be same as used in JQL. For example:

• reporter
• assignee
• issuetype
• priority
  etc.

Custom Fields

Custom Fields names also should be same as used in JQL. For example:

• Approver or  cf[10010]
• Hosting Server or cf[12910]
• Date to Join or cf[11000]
  etc.

Syntax for Values of the current Issue

Replaceable value from issue must be between curly brackets like

{issue.FIELD NAME}

System Fields

Use the place holders from the following list:

...

• {issue.Affects Version/s}
  Label in the english Jira user interface.
• {issue.versions}
  Technical field id. See also reference from Atlassian .
• {issue.affectedVersion}
  JQL's way to refer to that field.

Custom Fields

You can use either the name of a custom field, or it's id. For example:

• {issue.My Text Field}
• {issue.customfield_12345}

 If you have several custom fields with the same name, you must use the custom field id.

...