root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge branch '6.0.x'

This commit is contained in:
Sam Brannen 2023-09-29 16:53:01 +02:00
parent a3e13c8ba8 8e83f93bcb
commit cddff46165
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
spring-expression/src/main/java/org/springframework/expression/spel/ast/OpMultiply.java
View File

@ -123,7 +123,8 @@ public class OpMultiply extends Operator {
} }
private void checkRepeatedTextSize(String text, int count) { private void checkRepeatedTextSize(String text, int count) {
if (text.length() * count > MAX_REPEATED_TEXT_SIZE) { int result = text.length() * count;
if (result < 0 || result > MAX_REPEATED_TEXT_SIZE) {
throw new SpelEvaluationException(getStartPosition(), throw new SpelEvaluationException(getStartPosition(),
SpelMessage.MAX_REPEATED_TEXT_SIZE_EXCEEDED, MAX_REPEATED_TEXT_SIZE); SpelMessage.MAX_REPEATED_TEXT_SIZE_EXCEEDED, MAX_REPEATED_TEXT_SIZE);
} }

6
spring-expression/src/test/java/org/springframework/expression/spel/OperatorTests.java
View File

@ -579,6 +579,12 @@ class OperatorTests extends AbstractExpressionTests {
// 4 is the position of the '*' (repeat operator) // 4 is the position of the '*' (repeat operator)
evaluateAndCheckError("'a' * 257", String.class, MAX_REPEATED_TEXT_SIZE_EXCEEDED, 4); evaluateAndCheckError("'a' * 257", String.class, MAX_REPEATED_TEXT_SIZE_EXCEEDED, 4);
// Integer overflow: 2 * ((Integer.MAX_VALUE / 2) + 1) --> integer overflow
int repeatCount = (Integer.MAX_VALUE / 2) + 1;
assertThat(2 * repeatCount).isNegative();
// 5 is the position of the '*' (repeat operator)
evaluateAndCheckError("'ab' * " + repeatCount, String.class, MAX_REPEATED_TEXT_SIZE_EXCEEDED, 5);
} }
@Test @Test