Make maximum length of SpEL expressions in an ApplicationContext
configurable
#31952
Labels
in: core
Issues in core modules (aop, beans, core, context, expression)
type: enhancement
A general enhancement
Milestone
Affects: Spring Framework 5.2.24+
Background
Since #30325 (implemented in b73f5fc) the length of SpEL expressions is limited by default to 10000. As I understand it this is a mitigation against potential ReDoS exploits. However, in some cases this limitation is too low and prevents upgrading to recent Spring Framework versions.
While #30380 (implemented in aefcb9d) adds support for a custom
maximumExpressionLength
the feature is only accessible if one instantiates theSpelParserConfiguration
class themselves.In my case I would like to configure the
SpelParserConfiguration
created in the classStandardBeanExpressionResolver
to accept my very long property by raising themaximumExpressionLength
to a higher value than its default (10000).spring-framework/spring-context/src/main/java/org/springframework/context/expression/StandardBeanExpressionResolver.java
Lines 91 to 105 in 0709797
Use case
I've got a huge map in my config:
It is used by a property:
If I try to start my application I get the following exception:
Proposal
Make the parameter
maximumExpressionLength
ofSpelParserConfiguration
configurable when it is instantiated inStandardBeanExpressionResolver.java
(see the snippet above). Example (not sure what a conformant property name would be):spring.standardBeanExpressionResolver.maximumExpressionLength=20000
The text was updated successfully, but these errors were encountered: