From 76739a5b6b19dd5a16e9119b2c5010334e8c3da8 Mon Sep 17 00:00:00 2001
From: Marcin Grzejszczak <mgrzejszczak@pivotal.io>
Date: Thu, 5 Apr 2018 16:36:59 +0200
Subject: [PATCH] Added SPEL  support; fixes gh-917

---
 docs/src/main/asciidoc/spring-cloud-sleuth.adoc        |  2 ++
 .../annotation/SpelTagValueExpressionResolver.java     |  6 +++++-
 .../SpelTagValueExpressionResolverTests.java           | 10 ++++++++--
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/docs/src/main/asciidoc/spring-cloud-sleuth.adoc b/docs/src/main/asciidoc/spring-cloud-sleuth.adoc
index 814a04e8f..3f0dbbcb8 100644
--- a/docs/src/main/asciidoc/spring-cloud-sleuth.adoc
+++ b/docs/src/main/asciidoc/spring-cloud-sleuth.adoc
@@ -710,6 +710,8 @@ The precedence is as follows:
 . If the bean name has not been provided, try to evaluate an expression.
 We search for a `TagValueExpressionResolver` bean.
 The default implementation uses SPEL expression resolution.
+**IMPORTANT** from Sleuth 2.0.0 you can only reference properties
+from the SPEL expression. Method execution is not allowed due to security constraints.
 . If we do not find any expression to evaluate, return the `toString()` value of the parameter.
 
 ==== Custom extractor
diff --git a/spring-cloud-sleuth-core/src/main/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolver.java b/spring-cloud-sleuth-core/src/main/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolver.java
index 0995b6851..b2b06824b 100644
--- a/spring-cloud-sleuth-core/src/main/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolver.java
+++ b/spring-cloud-sleuth-core/src/main/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolver.java
@@ -21,6 +21,7 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.expression.Expression;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.SimpleEvaluationContext;
 
 /**
  * Uses SPEL to evaluate the expression. If an exception is thrown will return
@@ -35,9 +36,12 @@ class SpelTagValueExpressionResolver implements TagValueExpressionResolver {
 	@Override
 	public String resolve(String expression, Object parameter) {
 		try {
+			SimpleEvaluationContext context = SimpleEvaluationContext
+					.forReadOnlyDataBinding()
+					.build();
 			ExpressionParser expressionParser = new SpelExpressionParser();
 			Expression expressionToEvaluate = expressionParser.parseExpression(expression);
-			return expressionToEvaluate.getValue(parameter, String.class);
+			return expressionToEvaluate.getValue(context, parameter, String.class);
 		} catch (Exception e) {
 			log.error("Exception occurred while tying to evaluate the SPEL expression [" + expression + "]", e);
 		}
diff --git a/spring-cloud-sleuth-core/src/test/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolverTests.java b/spring-cloud-sleuth-core/src/test/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolverTests.java
index c43e55196..13ff87336 100644
--- a/spring-cloud-sleuth-core/src/test/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolverTests.java
+++ b/spring-cloud-sleuth-core/src/test/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolverTests.java
@@ -27,10 +27,16 @@ public class SpelTagValueExpressionResolverTests {
 	@Test
 	public void should_use_spel_to_resolve_a_value() throws Exception {
 		SpelTagValueExpressionResolver resolver = new SpelTagValueExpressionResolver();
+		MyObject myObject = new MyObject();
+		myObject.name = "hello";
 
-		String resolved = resolver.resolve("length() + 1", "foo");
+		String resolved = resolver.resolve("name + ' world'", myObject);
 
-		then(resolved).isEqualTo("4");
+		then(resolved).isEqualTo("hello world");
+	}
+
+	public static class MyObject {
+		public String name;
 	}
 
 	@Test