Make max length of SpEL expressions in an ApplicationContext configurable

This commit introduces support for a Spring property named
`spring.context.expression.maxLength`. When set, the value of that
property is used internally in StandardBeanExpressionResolver to
configure the SpelParserConfiguration used when evaluating String
values in bean definitions, @⁠Value, etc.

Closes gh-31952

spring-context/src/test/java/org/springframework/context/expression/ApplicationContextExpressionTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ import java.util.Properties;
 
 import org.junit.jupiter.api.Test;
 
+import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.ObjectFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -42,17 +43,24 @@ import org.springframework.beans.testfixture.beans.TestBean;
 import org.springframework.context.annotation.AnnotationConfigApplicationContext;
 import org.springframework.context.annotation.AnnotationConfigUtils;
 import org.springframework.context.support.GenericApplicationContext;
+import org.springframework.core.SpringProperties;
 import org.springframework.core.convert.support.DefaultConversionService;
 import org.springframework.core.convert.support.GenericConversionService;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
 import org.springframework.core.io.support.EncodedResource;
 import org.springframework.core.testfixture.io.SerializationTestUtils;
+import org.springframework.expression.spel.SpelEvaluationException;
 import org.springframework.util.FileCopyUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.springframework.context.expression.StandardBeanExpressionResolver.MAX_SPEL_EXPRESSION_LENGTH_PROPERTY_NAME;
 
 /**
+ * Integration tests for SpEL expression support in an {@code ApplicationContext}.
+ *
  * @author Juergen Hoeller
  * @author Sam Brannen
  * @since 3.0
@@ -268,6 +276,70 @@ class ApplicationContextExpressionTests {
 		}
 	}
 
+	@Test
+	void maxSpelExpressionLengthMustBeAnInteger() {
+		doWithMaxSpelExpressionLength("boom", () -> {
+			try (AnnotationConfigApplicationContext ac = new AnnotationConfigApplicationContext()) {
+				assertThatIllegalArgumentException()
+						.isThrownBy(ac::refresh)
+						.withMessageStartingWith("Failed to parse value for system property [%s]",
+								MAX_SPEL_EXPRESSION_LENGTH_PROPERTY_NAME)
+						.withMessageContaining("boom");
+			}
+		});
+	}
+
+	@Test
+	void maxSpelExpressionLengthMustBePositive() {
+		doWithMaxSpelExpressionLength("-99", () -> {
+			try (AnnotationConfigApplicationContext ac = new AnnotationConfigApplicationContext()) {
+				assertThatIllegalArgumentException()
+						.isThrownBy(ac::refresh)
+						.withMessage("Value [%d] for system property [%s] must be positive", -99,
+								MAX_SPEL_EXPRESSION_LENGTH_PROPERTY_NAME);
+			}
+		});
+	}
+
+	@Test
+	void maxSpelExpressionLength() {
+		final String expression = "#{ 'xyz' + 'xyz' + 'xyz' }";
+
+		// With the default max length of 10_000, the expression should succeed.
+		evaluateExpressionInBean(expression);
+
+		// With a max length of 20, the expression should fail.
+		doWithMaxSpelExpressionLength("20", () ->
+				assertThatExceptionOfType(BeanCreationException.class)
+					.isThrownBy(() -> evaluateExpressionInBean(expression))
+					.havingRootCause()
+						.isInstanceOf(SpelEvaluationException.class)
+						.withMessageEndingWith("exceeding the threshold of '20' characters"));
+	}
+
+	private static void doWithMaxSpelExpressionLength(String maxLength, Runnable action) {
+		try {
+			SpringProperties.setProperty(MAX_SPEL_EXPRESSION_LENGTH_PROPERTY_NAME, maxLength);
+			action.run();
+		}
+		finally {
+			SpringProperties.setProperty(MAX_SPEL_EXPRESSION_LENGTH_PROPERTY_NAME, null);
+		}
+	}
+
+	private static void evaluateExpressionInBean(String expression) {
+		try (AnnotationConfigApplicationContext ac = new AnnotationConfigApplicationContext()) {
+			GenericBeanDefinition bd = new GenericBeanDefinition();
+			bd.setBeanClass(String.class);
+			bd.getConstructorArgumentValues().addGenericArgumentValue(expression);
+			ac.registerBeanDefinition("str", bd);
+			ac.refresh();
+
+			String str = ac.getBean("str", String.class);
+			assertThat(str).isEqualTo("xyz".repeat(3)); // "#{ 'xyz' + 'xyz' + 'xyz' }"
+		}
+	}
+
 
 	@SuppressWarnings("serial")
 	public static class ValueTestBean implements Serializable {