SimpleEvaluationContext does not enforce read-only semantics
#33319
Assignees
Labels
in: core
Issues in core modules (aop, beans, core, context, expression)
status: backported
An issue that has been backported to maintenance branches
type: bug
A general bug
Milestone
Comments
sbrannen
added
type: bug
github-actions
bot
added
status: backported
This was referenced Aug 5, 2024
sbrannen
added a commit
to sbrannen/spring-framework
that referenced
this issue
Aug 6, 2024
SimpleEvaluationContext.forReadOnlyDataBinding() documents that it creates a SimpleEvaluationContext for read-only access to public properties; however, prior to this commit write access was not disabled for indexed structures when using the assignment operator, the increment operator, or the decrement operator. In order to better align with the documented contract for forReadOnlyDataBinding(), this commit makes it possible to disable assignment in general in order to enforce read-only semantics for SpEL's SimpleEvaluationContext when created via the forReadOnlyDataBinding() factory method. Specifically: - This commit introduces a new isAssignmentEnabled() "default" method in the EvaluationContext API, which returns true by default. - SimpleEvaluationContext overrides isAssignmentEnabled(), returning false if the context was created via the forReadOnlyDataBinding() factory method. - The Assign, OpDec, and OpInc AST nodes -- representing the assignment (=), increment (++), and decrement (--) operators, respectively -- now throw a SpelEvaluationException if assignment is disabled for the current EvaluationContext. Closes spring-projectsgh-33319
sbrannen
added a commit
that referenced
this issue
Aug 6, 2024
SimpleEvaluationContext.forReadOnlyDataBinding() documents that it creates a SimpleEvaluationContext for read-only access to public properties; however, prior to this commit write access was not disabled for indexed structures when using the assignment operator, the increment operator, or the decrement operator. In order to better align with the documented contract for forReadOnlyDataBinding(), this commit makes it possible to disable assignment in general in order to enforce read-only semantics for SpEL's SimpleEvaluationContext when created via the forReadOnlyDataBinding() factory method. Specifically: - This commit introduces a new isAssignmentEnabled() "default" method in the EvaluationContext API, which returns true by default. - SimpleEvaluationContext overrides isAssignmentEnabled(), returning false if the context was created via the forReadOnlyDataBinding() factory method. - The Assign, OpDec, and OpInc AST nodes -- representing the assignment (=), increment (++), and decrement (--) operators, respectively -- now throw a SpelEvaluationException if assignment is disabled for the current EvaluationContext. See gh-33319 Closes gh-33321 (cherry picked from commit 0127de5)
sbrannen
added a commit
that referenced
this issue
Aug 6, 2024
SimpleEvaluationContext.forReadOnlyDataBinding() documents that it creates a SimpleEvaluationContext for read-only access to public properties; however, prior to this commit write access was not disabled for indexed structures when using the assignment operator, the increment operator, or the decrement operator. In order to better align with the documented contract for forReadOnlyDataBinding(), this commit makes it possible to disable assignment in general in order to enforce read-only semantics for SpEL's SimpleEvaluationContext when created via the forReadOnlyDataBinding() factory method. Specifically: - This commit introduces a new isAssignmentEnabled() "default" method in the EvaluationContext API, which returns true by default. - SimpleEvaluationContext overrides isAssignmentEnabled(), returning false if the context was created via the forReadOnlyDataBinding() factory method. - The Assign, OpDec, and OpInc AST nodes -- representing the assignment (=), increment (++), and decrement (--) operators, respectively -- now throw a SpelEvaluationException if assignment is disabled for the current EvaluationContext. See gh-33319 Closes gh-33320 (cherry picked from commit e1ab306)
|
Reopening to introduce |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
SimpleEvaluationContext.forReadOnlyDataBinding()documents that it creates aSimpleEvaluationContextfor read-only access to public properties; however, that is only partially true. Write access is in fact disabled for properties accessed via the registeredDataBindingPropertyAccessor, but write access is not disabled for indexed structures when using the assignment operator, the increment operator, or the decrement operator.In order to better align with the documented contract for
forReadOnlyDataBinding(), we should make it possible to disable assignment (i.e., write access within a SpEL expression) in general in order to enforce read-only semantics for SpEL'sSimpleEvaluationContextwhen created via theforReadOnlyDataBinding()factory method.The text was updated successfully, but these errors were encountered: