EvaluationContextConfigurers.java

1 
package pro.verron.officestamper.preset;
2
3
4 
import org.springframework.expression.EvaluationContext;
5 
import org.springframework.expression.TypeLocator;
6 
import org.springframework.expression.spel.SpelEvaluationException;
7 
import org.springframework.expression.spel.SpelMessage;
8 
import org.springframework.expression.spel.support.*;
9 
import pro.verron.officestamper.api.EvaluationContextConfigurer;
10 
import pro.verron.officestamper.api.OfficeStamperException;
11
12 
import java.util.ArrayList;
13 
import java.util.Collections;
14 
import java.util.List;
15
16 
/**
17 
 * Utility class for configuring the EvaluationContext used by officestamper.
18 
 */
19 
public class EvaluationContextConfigurers {
20
21 
    private EvaluationContextConfigurers() {
22 
        throw new OfficeStamperException("EvaluationContextConfigurers cannot be instantiated");
23 
    }
24
25 
    /**
26 
     * Returns a {@link EvaluationContextConfigurer} instance that does no customization.
27 
     * <p>
28 
     * This configurer does nothing to the StandardEvaluationContext class, and therefore all the
29 
     * unfiltered features are accessible.
30 
     * It should be used when there is a need to use the
31 
     * powerful features of the aforementioned class, and there is a trust that the template won't
32 
     * contain any dangerous injections.
33 
     *
34 
     * @return a {@link EvaluationContextConfigurer} instance
35 
     */
36 
    public static EvaluationContextConfigurer noopConfigurer() {
37 1 1. noopConfigurer : replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::noopConfigurer → KILLED
 
        return new NoOpEvaluationContextConfigurer();
38 
    }
39
40 
    /**
41 
     * Returns a default {@link EvaluationContextConfigurer} instance.
42 
     * <p>
43 
     * The default configurer provides better default security for the
44 
     * {@link EvaluationContext} used by OfficeStamper.
45 
     * It sets up the context with enhanced security measures, such as
46 
     * limited property accessors, constructor resolvers, and method resolvers.
47 
     * It also sets a type locator, type converter, type comparator, and operator overloader.
48 
     * This configurer is recommended to be used when there is a need for improved security
49 
     * and protection against potential dangerous injections in the template.
50 
     *
51 
     * @return a {@link EvaluationContextConfigurer} instance with enhanced security features
52 
     */
53 
    public static EvaluationContextConfigurer defaultConfigurer() {
54 1 1. defaultConfigurer : replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::defaultConfigurer → KILLED
 
        return new DefaultEvaluationContextConfigurer();
55 
    }
56
57 
    /**
58 
     * {@link EvaluationContextConfigurer} that does no customization.
59 
     * <p>
60 
     * The NoOpEvaluationContextConfigurer is a configuration placeholder used to indicate the
61 
     * intention to keep the standard powerful features provided by the
62 
     * Spring framework's StandardEvaluationContext class.
63 
     * <p>
64 
     * StandardEvaluationContext is a powerful class by default, which can lead to potential security risks
65 
     * if not properly managed. This might include potential dangerous injections in the template.
66 
     * <p>
67 
     * This configurer does nothing to the StandardEvaluationContext class, and therefore all the
68 
     * unfiltered features are accessible. It should be used when there is a need to use the
69 
     * powerful features of the aforementioned class, and there is a trust that the template won't
70 
     * contain any dangerous injections.
71 
     *
72 
     * @author Joseph Verron
73 
     * @author Mario Siegenthaler
74 
     * @version ${version}
75 
     * @since 1.0.13
76 
     */
77 
    private static class NoOpEvaluationContextConfigurer
78 
            implements EvaluationContextConfigurer {
79 
        /**
80 
         * Configures the provided StandardEvaluationContext.
81 
         *
82 
         * @param context the StandardEvaluationContext to be configured, not null
83 
         */
84 
        @Override
85 
        public void configureEvaluationContext(StandardEvaluationContext context) {
86 
            // DO NOTHING
87 
        }
88 
    }
89
90 
    /**
91 
     * {@link EvaluationContextConfigurer} that has better default security,
92 
     * especially doesn't allow especially known injections.
93 
     *
94 
     * @author Joseph Verron
95 
     * @version ${version}
96 
     * @since 1.6.5
97 
     */
98 
    private static class DefaultEvaluationContextConfigurer
99 
            implements EvaluationContextConfigurer {
100 
        /**
101 
         * {@inheritDoc}
102 
         */
103 
        @Override
104 
        public void configureEvaluationContext(StandardEvaluationContext context) {
105 
            TypeLocator typeLocator = typeName -> {
106 
                throw new SpelEvaluationException(SpelMessage.TYPE_NOT_FOUND, typeName);
107 
            };
108 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → SURVIVED
 
            context.setPropertyAccessors(List.of(DataBindingPropertyAccessor.forReadWriteAccess()));
109 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setConstructorResolvers → SURVIVED
 
            context.setConstructorResolvers(Collections.emptyList());
110 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setMethodResolvers → SURVIVED
 
            context.setMethodResolvers(new ArrayList<>(List.of(DataBindingMethodResolver.forInstanceMethodInvocation())));
111 
            //noinspection DataFlowIssue, ignore the warning since it is a workaround fixing potential security issues
112 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setBeanResolver → SURVIVED
 
            context.setBeanResolver(null);
113 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeLocator → KILLED
 
            context.setTypeLocator(typeLocator);
114 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeConverter → SURVIVED
 
            context.setTypeConverter(new StandardTypeConverter());
115 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeComparator → SURVIVED
 
            context.setTypeComparator(new StandardTypeComparator());
116 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setOperatorOverloader → SURVIVED
 
            context.setOperatorOverloader(new StandardOperatorOverloader());
117 
        }
118 
    }
119 
}

Mutations

37

1.1
Location : noopConfigurer
Killed by : pro.verron.officestamper.test.SpelInstantiationTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.SpelInstantiationTest]/[method:testDateInstantiationAndResolution()] replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::noopConfigurer → KILLED

54

1.1
Location : defaultConfigurer
Killed by : pro.verron.officestamper.test.ResolutionTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.ResolutionTest]/[test-template:testCustomResolution(java.lang.String, boolean, boolean, boolean, boolean, boolean, java.lang.String, boolean, java.lang.String)]/[test-template-invocation:#22] replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::defaultConfigurer → KILLED

108

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → SURVIVED Covering tests

109

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setConstructorResolvers → SURVIVED Covering tests

110

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setMethodResolvers → SURVIVED Covering tests

112

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setBeanResolver → SURVIVED Covering tests

113

1.1
Location : configureEvaluationContext
Killed by : pro.verron.officestamper.test.ResolutionTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.ResolutionTest]/[test-template:testStaticResolution(java.lang.String, boolean, boolean, boolean, java.lang.String, java.lang.String)]/[test-template-invocation:#8] removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeLocator → KILLED

114

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeConverter → SURVIVED Covering tests

115

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeComparator → SURVIVED Covering tests

116

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setOperatorOverloader → SURVIVED Covering tests

Active mutators

Tests examined


Report generated by PIT 1.17.1