EvaluationContextConfigurers.java

1 
package pro.verron.officestamper.preset;
2
3
4 
import org.springframework.expression.EvaluationContext;
5 
import org.springframework.expression.TypeLocator;
6 
import org.springframework.expression.spel.SpelEvaluationException;
7 
import org.springframework.expression.spel.SpelMessage;
8 
import org.springframework.expression.spel.support.*;
9 
import pro.verron.officestamper.api.EvaluationContextConfigurer;
10 
import pro.verron.officestamper.api.OfficeStamperException;
11
12 
import java.util.ArrayList;
13 
import java.util.Collections;
14 
import java.util.List;
15
16 
/// Utility class for configuring the EvaluationContext used by officestamper.
17 
public class EvaluationContextConfigurers {
18
19 
    private EvaluationContextConfigurers() {
20 
        throw new OfficeStamperException("EvaluationContextConfigurers cannot be instantiated");
21 
    }
22
23 
    /// Returns a [EvaluationContextConfigurer] instance that does no customization.
24 
    ///
25 
    /// This configurer does nothing to the StandardEvaluationContext class, and therefore all the
26 
    /// unfiltered features are accessible.
27 
    /// It should be used when there is a need to use the
28 
    /// powerful features of the aforementioned class, and there is a trust that the template won't
29 
    /// contain any dangerous injections.
30 
    ///
31 
    /// @return a [EvaluationContextConfigurer] instance
32 
    public static EvaluationContextConfigurer noopConfigurer() {
33 1 1. noopConfigurer : replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::noopConfigurer → KILLED
 
        return new NoOpEvaluationContextConfigurer();
34 
    }
35
36 
    /// Returns a default [EvaluationContextConfigurer] instance.
37 
    ///
38 
    /// The default configurer provides better default security for the
39 
    /// [EvaluationContext] used by OfficeStamper.
40 
    /// It sets up the context with enhanced security measures, such as
41 
    /// limited property accessors, constructor resolvers, and method resolvers.
42 
    /// It also sets a type locator, type converter, type comparator, and operator overloader.
43 
    /// This configurer is recommended to be used when there is a need for improved security
44 
    /// and protection against potential dangerous injections in the template.
45 
    ///
46 
    /// @return a [EvaluationContextConfigurer] instance with enhanced security features
47 
    public static EvaluationContextConfigurer defaultConfigurer() {
48 1 1. defaultConfigurer : replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::defaultConfigurer → KILLED
 
        return new DefaultEvaluationContextConfigurer();
49 
    }
50
51 
    /// [EvaluationContextConfigurer] that does no customization.
52 
    ///
53 
    /// The NoOpEvaluationContextConfigurer is a configuration placeholder used to indicate the
54 
    /// intention to keep the standard powerful features provided by the
55 
    /// Spring framework's StandardEvaluationContext class.
56 
    ///
57 
    /// StandardEvaluationContext is a powerful class by default, which can lead to potential security risks
58 
    /// if not properly managed. This might include potential dangerous injections in the template.
59 
    ///
60 
    /// This configurer does nothing to the StandardEvaluationContext class, and therefore all the
61 
    /// unfiltered features are accessible. It should be used when there is a need to use the
62 
    /// powerful features of the aforementioned class, and there is a trust that the template won't
63 
    /// contain any dangerous injections.
64 
    ///
65 
    /// @author Joseph Verron
66 
    /// @author Mario Siegenthaler
67 
    /// @version ${version}
68 
    /// @since 1.0.13
69 
    private static class NoOpEvaluationContextConfigurer
70 
            implements EvaluationContextConfigurer {
71 
        /// Configures the provided StandardEvaluationContext.
72 
        ///
73 
        /// @param context the StandardEvaluationContext to be configured, not null
74 
        @Override
75 
        public void configureEvaluationContext(StandardEvaluationContext context) {
76 
            // Just add the MapAccessor to the standard list.
77 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → SURVIVED
 
            context.setPropertyAccessors(List.of(new ReflectivePropertyAccessor(), new MapAccessor()));
78 
        }
79 
    }
80
81 
    /// [EvaluationContextConfigurer] that has better default security,
82 
    /// especially doesn't allow especially known injections.
83 
    ///
84 
    /// @author Joseph Verron
85 
    /// @version ${version}
86 
    /// @since 1.6.5
87 
    private static class DefaultEvaluationContextConfigurer
88 
            implements EvaluationContextConfigurer {
89 
        /// {@inheritDoc}
90 
        @Override
91 
        public void configureEvaluationContext(StandardEvaluationContext context) {
92 
            TypeLocator typeLocator = typeName -> {
93 
                throw new SpelEvaluationException(SpelMessage.TYPE_NOT_FOUND, typeName);
94 
            };
95 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → KILLED
 
            context.setPropertyAccessors(List.of(DataBindingPropertyAccessor.forReadWriteAccess(), new MapAccessor()));
96 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setConstructorResolvers → SURVIVED
 
            context.setConstructorResolvers(Collections.emptyList());
97 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setMethodResolvers → SURVIVED
 
            context.setMethodResolvers(new ArrayList<>(List.of(DataBindingMethodResolver.forInstanceMethodInvocation())));
98 
            //noinspection DataFlowIssue, ignore the warning since it is a workaround fixing potential security issues
99 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setBeanResolver → SURVIVED
 
            context.setBeanResolver(null);
100 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeLocator → KILLED
 
            context.setTypeLocator(typeLocator);
101 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeConverter → SURVIVED
 
            context.setTypeConverter(new StandardTypeConverter());
102 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeComparator → SURVIVED
 
            context.setTypeComparator(new StandardTypeComparator());
103 1 1. configureEvaluationContext : removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setOperatorOverloader → SURVIVED
 
            context.setOperatorOverloader(new StandardOperatorOverloader());
104 
        }
105 
    }
106 
}

Mutations

33

1.1
Location : noopConfigurer
Killed by : pro.verron.officestamper.test.SpelInstantiationTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.SpelInstantiationTest]/[test-template:testDateInstantiationAndResolution(pro.verron.officestamper.test.ContextFactory)]/[test-template-invocation:#2] replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::noopConfigurer → KILLED

48

1.1
Location : defaultConfigurer
Killed by : pro.verron.officestamper.test.ResolutionTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.ResolutionTest]/[test-template:testCustomResolution(java.lang.String, boolean, boolean, boolean, boolean, boolean, java.lang.String, boolean, java.lang.String)]/[test-template-invocation:#22] replaced return value with null for pro/verron/officestamper/preset/EvaluationContextConfigurers::defaultConfigurer → KILLED

77

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → SURVIVED Covering tests

95

1.1
Location : configureEvaluationContext
Killed by : pro.verron.officestamper.test.WhitespaceTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.WhitespaceTest]/[test-template:should_preserve_spaces(pro.verron.officestamper.test.ContextFactory, java.lang.String, java.lang.String)]/[test-template-invocation:#5] removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setPropertyAccessors → KILLED

96

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setConstructorResolvers → SURVIVED Covering tests

97

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setMethodResolvers → SURVIVED Covering tests

99

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setBeanResolver → SURVIVED Covering tests

100

1.1
Location : configureEvaluationContext
Killed by : pro.verron.officestamper.test.ResolutionTest.[engine:junit-jupiter]/[class:pro.verron.officestamper.test.ResolutionTest]/[test-template:testStaticResolution(java.lang.String, boolean, boolean, boolean, java.lang.String, java.lang.String)]/[test-template-invocation:#6] removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeLocator → KILLED

101

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeConverter → SURVIVED Covering tests

102

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setTypeComparator → SURVIVED Covering tests

103

1.1
Location : configureEvaluationContext
Killed by : none removed call to org/springframework/expression/spel/support/StandardEvaluationContext::setOperatorOverloader → SURVIVED Covering tests

Active mutators

Tests examined


Report generated by PIT 1.21.0