SpringCloud/spring-cloud-sleuth
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Spel security fix; fixes gh-917

Browse Source
This commit is contained in:
Marcin Grzejszczak
2018-04-06 17:06:47 +02:00
parent 7e81e74a9c
commit 7f73677bc8
4 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-cloud-sleuth-core/src/main/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolver.java
View File

@@ -23,6 +23,7 @@ import org.apache.commons.logging.LogFactory;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.SimpleEvaluationContext;
/**
* Uses SPEL to evaluate the expression. If an exception is thrown will return
@@ -37,9 +38,12 @@ class SpelTagValueExpressionResolver implements TagValueExpressionResolver {
@Override
public String resolve(String expression, Object parameter) {
try {
SimpleEvaluationContext context = SimpleEvaluationContext
.forReadOnlyDataBinding()
.build();
ExpressionParser expressionParser = new SpelExpressionParser();
Expression expressionToEvaluate = expressionParser.parseExpression(expression);
return expressionToEvaluate.getValue(parameter, String.class);
return expressionToEvaluate.getValue(context, parameter, String.class);
} catch (Exception e) {
log.error("Exception occurred while tying to evaluate the SPEL expression [" + expression + "]", e);
}

10
spring-cloud-sleuth-core/src/test/java/org/springframework/cloud/sleuth/annotation/SpelTagValueExpressionResolverTests.java
View File

@@ -27,10 +27,16 @@ public class SpelTagValueExpressionResolverTests {
@Test
public void should_use_spel_to_resolve_a_value() throws Exception {
SpelTagValueExpressionResolver resolver = new SpelTagValueExpressionResolver();
MyObject myObject = new MyObject();
myObject.name = "hello";
String resolved = resolver.resolve("length() + 1", "foo");
String resolved = resolver.resolve("name + ' world'", myObject);
then(resolved).isEqualTo("4");
then(resolved).isEqualTo("hello world");
}
public static class MyObject {
public String name;
}
@Test