mirror of
https://github.com/spring-projects/spring-framework.git
synced 2026-09-17 16:39:29 +00:00
Sam Brannen
8a92c19e4d
This commit introduces a configurable limit on the estimated result size of BigDecimal and BigInteger power operations within SpEL expressions. The estimated result size in bits is computed as the product of the base value's bit length and the exponent. If this limit is exceeded, a SpelEvaluationException is thrown. The limit defaults to 1,000,000 bits, which is approximately equivalent to a decimal number with 300,000 digits, and can be configured either on a per-use-case basis via the new maximumBigPowerBits constructor argument in SpelParserConfiguration or globally as a JVM system property or Spring property named `spring.expression.maxBigPowerBits`. Parsers intended for trusted internal expressions may supply Integer.MAX_VALUE to remove the limit entirely. Closes ch-37034