spring-framework

Spring Framework

Sam Brannen 0127de5a7a Enforce read-only semantics in SpEL's SimpleEvaluationContext SimpleEvaluationContext.forReadOnlyDataBinding() documents that it creates a SimpleEvaluationContext for read-only access to public properties; however, prior to this commit write access was not disabled for indexed structures when using the assignment operator, the increment operator, or the decrement operator. In order to better align with the documented contract for forReadOnlyDataBinding(), this commit makes it possible to disable assignment in general in order to enforce read-only semantics for SpEL's SimpleEvaluationContext when created via the forReadOnlyDataBinding() factory method. Specifically: - This commit introduces a new isAssignmentEnabled() "default" method in the EvaluationContext API, which returns true by default. - SimpleEvaluationContext overrides isAssignmentEnabled(), returning false if the context was created via the forReadOnlyDataBinding() factory method. - The Assign, OpDec, and OpInc AST nodes -- representing the assignment (=), increment (++), and decrement (--) operators, respectively -- now throw a SpelEvaluationException if assignment is disabled for the current EvaluationContext. Closes gh-33319		2 years ago
..
jmh/java/org/springframework/expression/spel	Rewrite "performance" test to JMH benchmarks	5 years ago
main/java/org/springframework/expression	Enforce read-only semantics in SpEL's SimpleEvaluationContext	2 years ago
test	Enforce read-only semantics in SpEL's SimpleEvaluationContext	2 years ago