Sam Brannen 9b42a40a2a Document security implications of evaluating untrusted SpEL expressions ...

This commit clarifies in the Javadoc for EvaluationContext,
StandardEvaluationContext, and SimpleEvaluationContext (as well as in
the SpEL reference documentation) that StandardEvaluationContext must
never be used to evaluate expressions from an untrusted source, and
that SimpleEvaluationContext's restricted language and feature subset
is only a best-effort measure. The updated documentation also defines a
"trusted" source as a developer or administrator of the application and
points out that it is the responsibility of the code that configures an
EvaluationContext to ensure that no object reachable via the context
exposes dangerous operations.

Closes gh-36997

2026-07-29 21:21:11 +03:00

..

modules/ROOT

Document security implications of evaluating untrusted SpEL expressions

2026-07-29 21:21:11 +03:00

src

Update copyright headers in remaining source files

2026-04-27 11:26:35 +03:00

antora-playbook.yml

Sync changes to antora-playbook.yml from docs-build branch

2026-03-23 11:36:26 +01:00

antora.yml

Branch for 7.0.x maintenance

2026-03-13 10:22:01 +01:00

framework-docs.gradle

Pin Node.js version to 24.15.0

2026-05-27 12:01:09 +02:00

package.json

Update antora-extensions to 1.14.12

2026-05-28 10:57:11 +02:00