mirror of
https://github.com/spring-projects/spring-framework.git
synced 2026-09-17 08:24:13 +00:00
Sam Brannen
9b42a40a2a
This commit clarifies in the Javadoc for EvaluationContext, StandardEvaluationContext, and SimpleEvaluationContext (as well as in the SpEL reference documentation) that StandardEvaluationContext must never be used to evaluate expressions from an untrusted source, and that SimpleEvaluationContext's restricted language and feature subset is only a best-effort measure. The updated documentation also defines a "trusted" source as a developer or administrator of the application and points out that it is the responsibility of the code that configures an EvaluationContext to ensure that no object reachable via the context exposes dangerous operations. Closes gh-36997