INT-4443: Use SimpleEC for uriVariablesExpression

JIRA: https://jira.spring.io/browse/INT-4443

**cherry-pick to 5.0.x, 4.3.x**

Polishing; use data binding accessor in test evaluation contexts.

Add `.withInstanceMethods()`

See https://jira.spring.io/browse/SPR-16588?focusedCommentId=158041&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-158041

* Polishing according PR comments

spring-integration-http/src/main/java/org/springframework/integration/http/config/HttpOutboundChannelAdapterParser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -68,6 +68,7 @@ public class HttpOutboundChannelAdapterParser extends AbstractOutboundChannelAda
 		}
 		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "charset");
 		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "extract-payload");
+		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "trusted-spel");
 		HttpAdapterParsingUtils.setExpectedResponseOrExpression(element, parserContext, builder);
 		HttpAdapterParsingUtils.configureUriVariableExpressions(builder, parserContext, element);
 		return builder.getBeanDefinition();

spring-integration-http/src/main/java/org/springframework/integration/http/config/HttpOutboundGatewayParser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -76,6 +76,7 @@ public class HttpOutboundGatewayParser extends AbstractConsumerEndpointParser {
 		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "charset");
 		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "extract-request-payload",
 				"extractPayload");
+		IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "trusted-spel");
 
 		HttpAdapterParsingUtils.setExpectedResponseOrExpression(element, parserContext, builder);
 

spring-integration-http/src/main/java/org/springframework/integration/http/outbound/AbstractHttpRequestExecutingMessageHandler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2017 the original author or authors.
+ * Copyright 2017-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,7 +31,9 @@ import java.util.function.Supplier;
 import javax.xml.transform.Source;
 
 import org.springframework.core.ParameterizedTypeReference;
+import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
+import org.springframework.expression.spel.support.SimpleEvaluationContext;
 import org.springframework.expression.spel.support.StandardEvaluationContext;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpHeaders;
@@ -68,6 +70,7 @@ import org.springframework.web.util.UriComponentsBuilder;
  * @author Artem Bilan
  * @author Wallace Wadge
  * @author Shiliang Li
+ *
  * @since 5.0
  */
 public abstract class AbstractHttpRequestExecutingMessageHandler extends AbstractReplyProducingMessageHandler {
@@ -77,10 +80,14 @@ public abstract class AbstractHttpRequestExecutingMessageHandler extends Abstrac
 
 	private final Map<String, Expression> uriVariableExpressions = new HashMap<>();
 
-	private volatile StandardEvaluationContext evaluationContext;
-
 	private final Expression uriExpression;
 
+	private StandardEvaluationContext evaluationContext;
+
+	private SimpleEvaluationContext simpleEvaluationContext;
+
+	private boolean trustedSpel;
+
 	private volatile boolean encodeUri = true;
 
 	private volatile Expression httpMethodExpression = new ValueExpression<>(HttpMethod.POST);
@@ -247,9 +254,21 @@ public abstract class AbstractHttpRequestExecutingMessageHandler extends Abstrac
 		this.transferCookies = transferCookies;
 	}
 
+	/**
+	 * Set to true if you trust the source of SpEL expressions used to evaluate URI
+	 * variables. Default is false, which means a {@link SimpleEvaluationContext} is used
+	 * for evaluating such expressions, which restricts the use of some SpEL capabilities.
+	 * @param trustedSpel true to trust.
+	 * @since 4.3.15.
+	 */
+	public void setTrustedSpel(boolean trustedSpel) {
+		this.trustedSpel = trustedSpel;
+	}
+
 	@Override
 	protected void doInit() {
 		this.evaluationContext = ExpressionUtils.createStandardEvaluationContext(this.getBeanFactory());
+		this.simpleEvaluationContext = ExpressionUtils.createSimpleEvaluationContext(this.getBeanFactory());
 	}
 
 	@Override
@@ -526,18 +545,22 @@ public abstract class AbstractHttpRequestExecutingMessageHandler extends Abstrac
 	private Map<String, ?> determineUriVariables(Message<?> requestMessage) {
 		Map<String, ?> expressions;
 
+		EvaluationContext evaluationContextToUse = this.evaluationContext;
 		if (this.uriVariablesExpression != null) {
 			Object expressionsObject = this.uriVariablesExpression.getValue(this.evaluationContext, requestMessage);
 			Assert.state(expressionsObject instanceof Map,
 					"The 'uriVariablesExpression' evaluation must result in a 'Map'.");
 			expressions = (Map<String, ?>) expressionsObject;
+			if (!this.trustedSpel) {
+				evaluationContextToUse = this.simpleEvaluationContext;
+			}
 		}
 		else {
 			expressions = this.uriVariableExpressions;
 		}
 
 		return ExpressionEvalMap.from(expressions)
-				.usingEvaluationContext(this.evaluationContext)
+				.usingEvaluationContext(evaluationContextToUse)
 				.withRoot(requestMessage)
 				.build();
 

spring-integration-http/src/main/resources/org/springframework/integration/http/config/spring-integration-http-5.1.xsd

@@ -398,6 +398,18 @@
 					</xsd:documentation>
 				</xsd:annotation>
 			</xsd:attribute>
+			<xsd:attribute name="trusted-spel">
+				<xsd:annotation>
+					<xsd:documentation>
+						Set to 'true' if you trust SpEL expressions that might be evaluated to generate
+						URI variables.
+						The default value is 'false'.
+					</xsd:documentation>
+				</xsd:annotation>
+				<xsd:simpleType>
+					<xsd:union memberTypes="xsd:boolean xsd:string" />
+				</xsd:simpleType>
+			</xsd:attribute>
 		</xsd:complexType>
 	</xsd:element>
 
@@ -490,6 +502,18 @@
 					</xsd:attribute>
 					<xsd:attributeGroup ref="httpOutboundCommonAttributes"/>
 					<xsd:attributeGroup ref="syncHttpOutboundCommonAttributes"/>
+					<xsd:attribute name="trusted-spel">
+						<xsd:annotation>
+							<xsd:documentation>
+								Set to 'true' if you trust SpEL expressions that might be evaluated to generate
+								URI variables.
+								The default value is 'false'.
+							</xsd:documentation>
+						</xsd:annotation>
+						<xsd:simpleType>
+							<xsd:union memberTypes="xsd:boolean xsd:string" />
+						</xsd:simpleType>
+					</xsd:attribute>
 				</xsd:extension>
 			</xsd:complexContent>
 		</xsd:complexType>