Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Limit SpEL expression length

Browse Source 
This commit enforces a limit of the maximum size of a single SpEL
expression.

Closes gh-30329
This commit is contained in:
Sam Brannen
2023-04-07 18:13:02 +02:00
committed by Brian Clozel
parent 86457464d7
commit ebc8265428
3 changed files with 45 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
spring-expression/src/test/java/org/springframework/expression/spel/EvaluationTests.java
View File

@@ -60,6 +60,20 @@ class EvaluationTests extends AbstractExpressionTests {
@Nested
class MiscellaneousTests {
@Test
void expressionLength() {
String expression = String.format("'X' + '%s'", repeat(" ", 9_992));
assertThat(expression).hasSize(10_000);
Expression expr = parser.parseExpression(expression);
String result = expr.getValue(context, String.class);
assertThat(result).hasSize(9_993);
assertThat(result.trim()).isEqualTo("X");
expression = String.format("'X' + '%s'", repeat(" ", 9_993));
assertThat(expression).hasSize(10_001);
evaluateAndCheckError(expression, String.class, SpelMessage.MAX_EXPRESSION_LENGTH_EXCEEDED);
}
@Test
void createListsOnAttemptToIndexNull01() throws EvaluationException, ParseException {
ExpressionParser parser = new SpelExpressionParser(new SpelParserConfiguration(true, true));
@@ -492,14 +506,6 @@ class EvaluationTests extends AbstractExpressionTests {
evaluateAndCheckError("'abc' matches '" + pattern + "'", Boolean.class, SpelMessage.MAX_REGEX_LENGTH_EXCEEDED);
}
private String repeat(String str, int count) {
String result = "";
for (int i = 0; i < count; i++) {
result += str;
}
return result;
}
}
@Nested
@@ -1474,6 +1480,15 @@ class EvaluationTests extends AbstractExpressionTests {
}
private static String repeat(String str, int count) {
String result = "";
for (int i = 0; i < count; i++) {
result += str;
}
return result;
}
@SuppressWarnings("rawtypes")
static class TestClass {