Skip to content

ConfigurationPropertyName incorrectly accepts an opening square bracket at the end of a name - #52206

Open
zhoubiao188 wants to merge 1 commit into
spring-projects:4.0.xfrom
zhoubiao188:fix-configuration-name-unterminated-bracket
Open

zhoubiao188 wants to merge 1 commit into
spring-projects:4.0.xfrom
zhoubiao188:fix-configuration-name-unterminated-bracket

Conversation

@zhoubiao188

Copy link
Copy Markdown
Contributor

ConfigurationPropertyName rejects names with a bracket that is left unterminated.
ElementsParser.parse records this by marking the element it is currently building as
NON_UNIFORM, and elementsOf rejects any name that contains a NON_UNIFORM element:

if (openBracketCount != 0) {
    type = ElementType.NON_UNIFORM;
}
add(start, length, type, valueProcessor);

When the unbalanced bracket is the last character of the name, the element being
built is empty and add discards empty elements, taking the NON_UNIFORM marker with
it. Such names are accepted:

ConfigurationPropertyName.of("foo[");       // no exception
ConfigurationPropertyName.isValid("foo[");  // true

while the equivalent names with content are correctly rejected:

ConfigurationPropertyName.of("[bar");    // InvalidConfigurationPropertyNameException
ConfigurationPropertyName.of("foo[bar"); // InvalidConfigurationPropertyNameException

The accepted name is also self-inconsistent. Its only element is foo, but toString()
returns foo[ (the source is used as a shortcut), so it is not equal to the name foo
and it does not round-trip through ConfigurationPropertyName.of.

With this change the unbalanced bracket is included in the final element so that it is
not dropped as an empty element, and the name is reported as invalid — the same outcome
as for foo[bar:

ConfigurationPropertyName.of("foo[");       // InvalidConfigurationPropertyNameException
ConfigurationPropertyName.isValid("foo[");  // false

InvalidConfigurationPropertyNameException.getInvalidCharacters() reports [, which
matches the existing behaviour for [bar.

Regression tests are included for foo[, for the name consisting of just [, and for
isValid. Without the fix these fail; with it they pass. The rest of the
org.springframework.boot.context.properties test tree is unaffected.

…e end

ElementsParser marks the element it is building as NON_UNIFORM when a bracket
is left unterminated, which is how names such as "[bar" or "bar]" are
rejected. When the unterminated bracket is the last character of the name,
the element being built is empty and ElementsParser.add discards empty
elements, taking the NON_UNIFORM marker with it. Such names are accepted:

	ConfigurationPropertyName.of("foo[");      // no exception
	ConfigurationPropertyName.isValid("foo["); // true

The resulting name is also inconsistent. Its only element is "foo" while
toString() is "foo[", so it is not equal to the name "foo" and does not
round-trip through ConfigurationPropertyName.of.

The unbalanced bracket is now included in the final element so that it is
not dropped as an empty element and the name is reported as invalid, which
is already the case for "foo[bar".

Signed-off-by: zhoubiao188 <32508238+zhoubiao188@users.noreply.github.com>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Oct 14, 2026
@wilkinsona wilkinsona changed the title Fix ConfigurationPropertyName accepting an unterminated bracket at the end of a name ConfigurationPropertyName incorrectly accepts an opening square bracket at the end of a name Oct 14, 2026
@wilkinsona wilkinsona added type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Oct 14, 2026
@wilkinsona wilkinsona added this to the 4.0.x milestone Oct 14, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: bug A general bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants