From 0fe0a8a1169d3e68f6567773d161d2a1eb4cba5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Fern=C3=A1ndez?= <daniel.fernandez@11thlabs.org>
Date: Wed, 9 Dec 2020 01:25:35 +0100
Subject: [PATCH] Added tests for the implementation of #809 in OGNL-based
 scenarios

---
 .../util/StandardExpressionUtilsTest.java     | 56 +++++++++++++++++++
 .../accessrestrictions37.thtest               |  7 +++
 .../accessrestrictions38.thtest               |  7 +++
 .../accessrestrictions39.thtest               |  7 +++
 .../accessrestrictions40.thtest               |  7 +++
 .../accessrestrictions41.thtest               |  7 +++
 .../accessrestrictions42.thtest               |  7 +++
 .../accessrestrictions43.thtest               |  7 +++
 .../accessrestrictions44.thtest               |  7 +++
 .../accessrestrictions45.thtest               |  7 +++
 .../accessrestrictions46.thtest               |  7 +++
 .../accessrestrictions47.thtest               |  7 +++
 .../accessrestrictions48.thtest               |  7 +++
 .../features/util/util02.thtest               | 14 +++--
 14 files changed, 150 insertions(+), 4 deletions(-)
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions37.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions38.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions39.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions40.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions41.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions42.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions43.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions44.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions45.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions46.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions47.thtest
 create mode 100644 src/test/resources/templateengine/features/accessrestrictions/accessrestrictions48.thtest

diff --git a/src/test/java/org/thymeleaf/util/StandardExpressionUtilsTest.java b/src/test/java/org/thymeleaf/util/StandardExpressionUtilsTest.java
index 9764a8fd..8d84c9fe 100644
--- a/src/test/java/org/thymeleaf/util/StandardExpressionUtilsTest.java
+++ b/src/test/java/org/thymeleaf/util/StandardExpressionUtilsTest.java
@@ -45,4 +45,60 @@ public void testMightNeedExpressionObjects() {
 
     }
 
+
+    @Test
+    public void testContainsOGNLInstantiationOrStatic() {
+
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abcnew"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abcnew "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc3new "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc_new "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc$new "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc-new "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc new "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc.new "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc newnew"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abcnew ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc new ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc new w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc new w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc (new )w ewnew"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc (new)w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("abc +new )w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("newnew"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("(new )w ewnew"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("(new)w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("+new )w ewnew"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("!new )w ewnew"));
+
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.SomeClass@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.SomenewClass@"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.Some Class@"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.Some newClass@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.Some new Class@"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.Some newClass@new"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("@a.b.Some newClass@new "));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("new@a.b.Some newClass@new"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a@a.b.Some newClass@a"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.Some newClass@ a"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic(" a@a.b.Some newClass@a "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a@a.b.SomeClass@a"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.SomeClass@ a"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic(" a@a.b.SomeClass@a "));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.SomeClass@ a @a.b.Some Class@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.Some Class@ a @a.b.SomeClass@"));
+        Assert.assertFalse(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.Some Class@ a @a.b.Some Class@"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.SomeClass@ @"));
+        Assert.assertTrue(StandardExpressionUtils.containsOGNLInstantiationOrStatic("a @a.b.SomeClass@@"));
+
+    }
+
 }
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions37.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions37.thtest
new file mode 100644
index 00000000..5987aa5a
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions37.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="${new java.lang.String('hello')}">ALLOWED</p>
+# ------------------------------------------------------------
+%OUTPUT
+<p>hello</p>
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions38.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions38.thtest
new file mode 100644
index 00000000..2b609161
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions38.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="${__${new java.lang.String('hello')}__}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions39.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions39.thtest
new file mode 100644
index 00000000..4b36f7dd
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions39.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:at0="${new java.lang.String('hello')}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions40.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions40.thtest
new file mode 100644
index 00000000..d518e31b
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions40.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:attr="at0=${new java.lang.String('hello')}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions41.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions41.thtest
new file mode 100644
index 00000000..70ba2b95
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions41.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:href="~{${new java.lang.String('hello')}}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions42.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions42.thtest
new file mode 100644
index 00000000..f685ea66
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions42.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:insert="${new java.lang.String('hello')}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions43.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions43.thtest
new file mode 100644
index 00000000..31bdf26a
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions43.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="@{${new java.lang.String('hello')}}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions44.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions44.thtest
new file mode 100644
index 00000000..fdd7a8b3
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions44.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="${@org.thymeleaf.TemplateEngine@TIMER_LOGGER_NAME}">ALLOWED</p>
+# ------------------------------------------------------------
+%OUTPUT
+<p>org.thymeleaf.TemplateEngine.TIMER</p>
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions45.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions45.thtest
new file mode 100644
index 00000000..e9ae76de
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions45.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="${__${@org.thymeleaf.TemplateEngine@TIMER_LOGGER_NAME}__}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions46.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions46.thtest
new file mode 100644
index 00000000..869a8f60
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions46.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:at0="${@org.thymeleaf.TemplateEngine@TIMER_LOGGER_NAME}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions47.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions47.thtest
new file mode 100644
index 00000000..197de58b
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions47.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:href="~{${@org.thymeleaf.TemplateEngine@TIMER_LOGGER_NAME}}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions48.thtest b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions48.thtest
new file mode 100644
index 00000000..cafe12f5
--- /dev/null
+++ b/src/test/resources/templateengine/features/accessrestrictions/accessrestrictions48.thtest
@@ -0,0 +1,7 @@
+%EXTENDS ../html5.01.common
+# ------------------------------------------------------------
+%INPUT
+<p th:text="@{${@org.thymeleaf.TemplateEngine@TIMER_LOGGER_NAME}}">NOT ALLOWED</p>
+# ------------------------------------------------------------
+%EXCEPTION org.thymeleaf.exceptions.TemplateProcessingException
+%EXCEPTION_MESSAGE_PATTERN (.*)\Qforbidden in this context\E(.*)
diff --git a/src/test/resources/templateengine/features/util/util02.thtest b/src/test/resources/templateengine/features/util/util02.thtest
index 6b88e724..04293ffd 100755
--- a/src/test/resources/templateengine/features/util/util02.thtest
+++ b/src/test/resources/templateengine/features/util/util02.thtest
@@ -1,11 +1,17 @@
 %TEMPLATE_MODE TEXT
 # ------------------------------------------------------------
+%CONTEXT
+hourOfDayField = @java.util.Calendar@HOUR_OF_DAY
+minuteField = @java.util.Calendar@MINUTE
+secondField = @java.util.Calendar@SECOND
+millisecondField = @java.util.Calendar@MILLISECOND
+# ------------------------------------------------------------
 %INPUT
 [# th:with="date = ${#calendars.createToday()}"
-   th:text="${date.get(@java.util.Calendar@HOUR_OF_DAY) + ' ' + 
-              date.get(@java.util.Calendar@MINUTE) + ' ' + 
-              date.get(@java.util.Calendar@SECOND) + ' ' + 
-              date.get(@java.util.Calendar@MILLISECOND)}"]should all be zero[/]
+   th:text="${date.get(hourOfDayField) + ' ' +
+              date.get(minuteField) + ' ' +
+              date.get(secondField) + ' ' +
+              date.get(millisecondField)}"]should all be zero[/]
 # ------------------------------------------------------------
 %OUTPUT
 0 0 0 0
\ No newline at end of file