Overview
For web data binding, we already provide guidance for Model Design; however, we do not yet provide such guidance for SpEL.
To better inform users, we should introduce dedicated documentation in the SpEL section of the reference manual to make it clear to users of SpEL that it is their responsibility to carefully design any object that may be reached from a SpEL expression evaluated against untrusted input.
In addition, we should clearly explain that "property accessors" in SpEL expressions include any methods that look like properties: public, non-void methods that do not accept any arguments.
Related Issues
Overview
For web data binding, we already provide guidance for Model Design; however, we do not yet provide such guidance for SpEL.
To better inform users, we should introduce dedicated documentation in the SpEL section of the reference manual to make it clear to users of SpEL that it is their responsibility to carefully design any object that may be reached from a SpEL expression evaluated against untrusted input.
In addition, we should clearly explain that "property accessors" in SpEL expressions include any methods that look like properties: public, non-void methods that do not accept any arguments.
Related Issues
ake it