Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reject null and empty SpEL expressions

Browse Source 
Prior to gh-30325, supplying a null reference for a SpEL expression was
effectively equivalent to supplying the String "null" as the
expression. Consequently, evaluation of a null reference expression
always evaluated to a null reference. However, that was accidental
rather than by design.

Due to the introduction of the checkExpressionLength(String) method in
InternalSpelExpressionParser (in conjunction with gh-30325), an attempt
to evaluate a null reference as a SpEL expression now results in a
NullPointerException.

To address both of these issues,
TemplateAwareExpressionParser.parseExpression() and
SpelExpressionParser.parseRaw() now reject null and empty SpEL
expressions.

See gh-30371
Closes gh-30373
This commit is contained in:
Sam Brannen
2023-04-25 13:16:10 +02:00
parent 5afd94f90f
commit 964950a8b9
4 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-expression/src/main/java/org/springframework/expression/common/TemplateAwareExpressionParser.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ import org.springframework.expression.ExpressionParser;
import org.springframework.expression.ParseException;
import org.springframework.expression.ParserContext;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
/**
* An expression parser that understands templates. It can be subclassed by expression
@@ -34,6 +35,7 @@ import org.springframework.lang.Nullable;
* @author Keith Donald
* @author Juergen Hoeller
* @author Andy Clement
* @author Sam Brannen
* @since 3.0
*/
public abstract class TemplateAwareExpressionParser implements ExpressionParser {
@@ -46,9 +48,11 @@ public abstract class TemplateAwareExpressionParser implements ExpressionParser
@Override
public Expression parseExpression(String expressionString, @Nullable ParserContext context) throws ParseException {
if (context != null && context.isTemplate()) {
Assert.notNull(expressionString, "'expressionString' must not be null");
return parseTemplate(expressionString, context);
}
else {
Assert.hasText(expressionString, "'expressionString' must not be null or blank");
return doParseExpression(expressionString, context);
}
}

4
spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpressionParser.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2014 the original author or authors.
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ import org.springframework.util.Assert;
*
* @author Andy Clement
* @author Juergen Hoeller
* @author Sam Brannen
* @since 3.0
*/
public class SpelExpressionParser extends TemplateAwareExpressionParser {
@@ -53,6 +54,7 @@ public class SpelExpressionParser extends TemplateAwareExpressionParser {
public SpelExpression parseRaw(String expressionString) throws ParseException {
Assert.hasText(expressionString, "'expressionString' must not be null or blank");
return doParseExpression(expressionString, null);
}