diff --git a/spring-webflow/src/main/java/org/springframework/webflow/mvc/view/AbstractMvcView.java b/spring-webflow/src/main/java/org/springframework/webflow/mvc/view/AbstractMvcView.java index cfc48957..8c553386 100644 --- a/spring-webflow/src/main/java/org/springframework/webflow/mvc/view/AbstractMvcView.java +++ b/spring-webflow/src/main/java/org/springframework/webflow/mvc/view/AbstractMvcView.java @@ -18,13 +18,19 @@ package org.springframework.webflow.mvc.view; import java.io.IOException; import java.io.Serializable; import java.lang.reflect.Array; +import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Set; +import javax.lang.model.SourceVersion; + import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; + +import org.springframework.beans.BeanWrapperImpl; +import org.springframework.beans.PropertyAccessorUtils; import org.springframework.binding.convert.ConversionExecutor; import org.springframework.binding.convert.ConversionService; import org.springframework.binding.expression.EvaluationException; @@ -508,6 +514,7 @@ public abstract class AbstractMvcView implements View { protected void addDefaultMapping(DefaultMapper mapper, String parameter, Object model) { Expression source = new RequestParameterExpression(parameter); ParserContext parserContext = new FluentParserContext().evaluate(model.getClass()); + validateDataBindingExpression(parameter, model); Expression target = expressionParser.parseExpression(parameter, parserContext); DefaultMapping mapping = new DefaultMapping(source, target); if (logger.isDebugEnabled()) { @@ -516,6 +523,49 @@ public abstract class AbstractMvcView implements View { mapper.addMapping(mapping); } + /** + * Check that the expression is a property path where each nested property + * is a {@link SourceVersion#isName(CharSequence) valid Java identifier} and + * that the first nested property name at least is a valid readable property + * on the target object. + */ + private void validateDataBindingExpression(String expression, Object model) { + + if (expressionParser instanceof BeanWrapperExpressionParser) { + return; + } + + String errorMessage = "Invalid data binding expression: '" + expression + "' " + + "for target model class '" + model.getClass() + "'"; + + List propertyNames = new ArrayList(); + while (true) { + int index = PropertyAccessorUtils.getFirstNestedPropertySeparatorIndex(expression); + String nestedProperty = index != -1 ? expression.substring(0, index) : expression; + nestedProperty = PropertyAccessorUtils.getPropertyName(nestedProperty); + propertyNames.add(nestedProperty); + if (index == -1) { + break; + } + if (expression.length() == index + 1) { + throw new IllegalStateException(errorMessage); + } + expression = expression.substring(index + 1); + } + + BeanWrapperImpl beanWrapper = new BeanWrapperImpl(model); + if (!beanWrapper.isReadableProperty(propertyNames.get(0))) { + throw new IllegalStateException(errorMessage); + } + + for (int i=0; i < propertyNames.size(); i++) { + if (!SourceVersion.isName(propertyNames.get(i))) { + throw new IllegalStateException(errorMessage); + } + } + + } + // package private /**