CVE-2022-22947分析
[[spel inj|SPEL]] CASTING AND EVIL BEANS
Base
Source 分析
查看 v3.0.6->v3.0.7
的官方补丁 Comparing v3.0.6…v3.0.7 · spring-cloud/spring-cloud-gateway,官方在 ShortcutConfigurable#getValue
方法中将 StandardEvaluationContext
修正成了 GatewayEvaluationContext
static
Object
getValue(SpelExpressionParser parser
,
BeanFactory beanFactory
,
String entryValue
)
{
Object value
;
String rawValue
= entryValue
;
if
(rawValue
!=
null)
{
rawValue
= rawValue
.trim();
}
if
(rawValue
!=
null
&& rawValue
.startsWith("#{")
&& entryValue
.endsWith("}"))
{
// assume it's spel
StandardEvaluationContext context
=
new
StandardEvaluationContext();
context
.setBeanResolver(new
BeanFactoryResolver(beanFactory
));
Expression expression
= parser
.parseExpression(entryValue
,
new
TemplateParserContext());
value
= expression
.getValue