Skip to content

Reject null and empty SpEL expressions #30371

Closed
@ryan-c-wicks

Description

@ryan-c-wicks

We have upgraded from Spring Framework 5.2.23 to 5.2.24, and now we are getting some NullPointerExceptions.

Looking in the stack traces we find that the issue is in InternalSpelExpressionParser.

With 5.2.24 there is now a 'checkExpressionLength(expressionString);' which calls:

	private void checkExpressionLength(String string) {
		if (string.length() > MAX_EXPRESSION_LENGTH) {
			throw new SpelEvaluationException(SpelMessage.MAX_EXPRESSION_LENGTH_EXCEEDED, MAX_EXPRESSION_LENGTH);
		}
	}

If string is null then string.length() results in a NullPointerException.

Is this the intended behavior of checkExpressionLength(), or is this a bug?

Metadata

Metadata

Assignees

Labels

in: coreIssues in core modules (aop, beans, core, context, expression)status: backportedAn issue that has been backported to maintenance branchestype: enhancementA general enhancement

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions