WARNING: Evaluating a SpEL expression obtained from an - * untrusted source is inherently dangerous, since doing so can effectively - * grant that source the ability to execute arbitrary code within the - * application. See the class-level documentation for - * {@code StandardEvaluationContext} and {@code SimpleEvaluationContext} for - * details on the trust model applicable to each implementation. Regardless of - * which {@code EvaluationContext} implementation is in use, any restrictions - * that an implementation imposes on the SpEL language are provided on a - * best-effort basis and do not, by themselves, guarantee that expression - * evaluation is safe. An expression can potentially invoke any property, method, - * or function reachable via the configured root object, property accessors, - * index accessors, resolvers, variables, and functions. It is therefore the - * responsibility of the code that configures an {@code EvaluationContext} - * — for example, by supplying a root object or by registering property - * accessors, resolvers, variables, or functions — to ensure that none of - * those reachable objects expose operations that would be dangerous if invoked - * by an expression from an untrusted source. + *
WARNING: Special security considerations apply to the + * evaluation of SpEL expressions, particularly those obtained from an untrusted + * source. See the + * Security Considerations section of the Spring Framework reference + * documentation for details, as well as the class-level documentation for + * {@code StandardEvaluationContext} and {@code SimpleEvaluationContext}. * *
An {@code EvaluationContext} is designed to be built once and reused across * many evaluations, potentially of many different {@link Expression} instances. A diff --git a/spring-expression/src/main/java/org/springframework/expression/spel/support/SimpleEvaluationContext.java b/spring-expression/src/main/java/org/springframework/expression/spel/support/SimpleEvaluationContext.java index e7023eabf0f..e621bb38ee2 100644 --- a/spring-expression/src/main/java/org/springframework/expression/spel/support/SimpleEvaluationContext.java +++ b/spring-expression/src/main/java/org/springframework/expression/spel/support/SimpleEvaluationContext.java @@ -88,22 +88,14 @@ import org.springframework.expression.spel.SpelMessage; *
For more power and flexibility, in particular for internal configuration * scenarios, consider using {@link StandardEvaluationContext} instead. * - *
WARNING: {@code SimpleEvaluationContext} takes a - * best-effort approach to restricting the SpEL language to a subset of its - * features; however, it cannot guarantee that evaluation of an expression is - * safe. Evaluating a SpEL expression obtained from an untrusted source is inherently - * dangerous and should generally be avoided, since doing so can effectively grant - * that source the ability to execute arbitrary code within the application. Even - * within the restricted language subset supported by {@code SimpleEvaluationContext}, - * an expression can potentially invoke any property, method, or function reachable - * via the configured root object, property accessors, method resolvers, variables, - * and functions. It is therefore the responsibility of the code that configures a - * {@code SimpleEvaluationContext} — for example, by supplying a root - * object or by registering property accessors, method resolvers, variables, or - * functions — to ensure that none of those reachable objects expose - * operations that would be dangerous if invoked by an expression from an - * untrusted source. For details on what qualifies as a "trusted" source, see - * {@link StandardEvaluationContext}. + *
WARNING: Although {@code SimpleEvaluationContext} restricts + * the SpEL language to a subset of its features, that restriction is provided on + * a best-effort basis and does not guarantee that evaluation of an expression is + * safe; {@code SimpleEvaluationContext} must not be considered safe for evaluating + * a SpEL expression obtained from an untrusted source. See the + * Security Considerations section of the Spring Framework reference + * documentation for details. * *
Because a parsed {@code Expression} may cache accessor and executor state * resolved against a particular {@code EvaluationContext} configuration, a parsed diff --git a/spring-expression/src/main/java/org/springframework/expression/spel/support/StandardEvaluationContext.java b/spring-expression/src/main/java/org/springframework/expression/spel/support/StandardEvaluationContext.java index 469ce92df03..1a14565beb0 100644 --- a/spring-expression/src/main/java/org/springframework/expression/spel/support/StandardEvaluationContext.java +++ b/spring-expression/src/main/java/org/springframework/expression/spel/support/StandardEvaluationContext.java @@ -65,20 +65,12 @@ import org.springframework.util.Assert; * opting into several SpEL features as needed by specific use cases. * *
WARNING: {@code StandardEvaluationContext} exposes the - * complete SpEL language, including the ability to invoke arbitrary constructors - * and methods and to read and write arbitrary properties and fields — all - * backed by reflection — as well as the ability to reference beans in an - * {@code ApplicationContext} via a configured {@link BeanResolver}. For that - * reason, a {@code StandardEvaluationContext} must never be used - * to evaluate a SpEL expression obtained from an untrusted source. In this context, - * a "trusted" source is limited to a developer of the application or an - * administrator who is responsible for configuring or operating the - * application. Any other source of a SpEL expression — for example, an - * expression supplied by an end user or received from an external system - * — must be treated as untrusted. Note, however, that evaluating a SpEL - * expression obtained from an untrusted source is inherently dangerous - * regardless of the {@code EvaluationContext} implementation in use; see - * {@link SimpleEvaluationContext} for further details. + * complete SpEL language, backed by reflection, and must never + * be used to evaluate a SpEL expression obtained from an untrusted source. See + * the + * Security Considerations section of the Spring Framework reference + * documentation for details, including the definition of a "trusted" source. * *
Because a parsed {@code Expression} may cache accessor and executor state * resolved against a particular {@code EvaluationContext} configuration, a parsed