Spring Expression Language (SpEL)

@Value("#{42}")              // int
@Value("#{'Hello World'}")   // String
@Value("#{true}")            // boolean
@Value("#{3.14}")            // double
@Value("#{null}")            // null

@Value("#{systemProperties['java.version']}")
private String javaVersion;

@Value("#{environment['SPRING_PROFILES_ACTIVE']}")
private String activeProfile;

@Value("#{'hello world'.toUpperCase()}")
private String upper;  // "HELLO WORLD"

@Value("#{'spring framework'.split(' ').length}")
private int wordCount;  // 2

// Nested property access
@Value("#{employee.address.city}")
private String city;

// Array/List indexing
@Value("#{cities[0]}")
private String firstCity;

// Map access
@Value("#{settings['timeout']}")
private int timeout;

@Value("#{employee?.address?.city}")
private String city;  // null if employee or address is null

// Select all active users
@Value("#{users.?[active == true]}")
private List<User> activeUsers;

// First match (.^[])
@Value("#{users.^[age > 30]}")
private User firstOver30;

// Last match (.$[])
@Value("#{users.$[age > 30]}")
private User lastOver30;

// Extract all names from user list
@Value("#{users.![name]}")
private List<String> userNames;

// Extract nested property
@Value("#{orders.![item.price]}")
private List<Double> prices;

// Static method call
@Value("#{T(java.lang.Math).random()}")
private double randomValue;

// Static field
@Value("#{T(java.lang.Integer).MAX_VALUE}")
private int maxInt;

// Enum reference
@Value("#{T(com.app.enums.Status).ACTIVE}")
private Status activeStatus;

// Utility method
@Value("#{T(java.util.UUID).randomUUID().toString()}")
private String uuid;

@Value("#{@userService.getDefaultUser()}")
private User defaultUser;

@Value("#{@configProperties.maxRetries}")
private int maxRetries;

// In @PreAuthorize
@PreAuthorize("@securityService.canAccess(#id)")
public Resource getResource(Long id) { ... }

// Mix literal text with SpEL
@Value("Server running on #{@serverConfig.host}:#{@serverConfig.port}")
private String serverInfo;

// Conditional value
@Value("#{${feature.enabled} ? 'Feature ON' : 'Feature OFF'}")
private String featureStatus;

// Property with default
@Value("#{${app.timeout:5000}}")
private int timeout;

ExpressionParser parser = new SpelExpressionParser();
StandardEvaluationContext context = new StandardEvaluationContext();
context.setVariable("users", userList);

// Filter: users older than 25
List<User> filtered = parser.parseExpression(
    "#users.?[age > 25]"
).getValue(context, List.class);

// Project: extract emails
List<String> emails = parser.parseExpression(
    "#users.![email]"
).getValue(context, List.class);

// Combined: emails of active users over 25
List<String> result = parser.parseExpression(
    "#users.?[age > 25 and active].![email]"
).getValue(context, List.class);

@Cacheable(
    value = "reports",
    key = "#departments.?[active].![id].toString()"
)
public List<Report> getReports(List<Department> departments) { ... }

@Value("#{${server.port} > 8080 ? 'non-standard' : 'standard'}")
private String portCategory;

@PreAuthorize("#user.role == 'ADMIN' ? true : #user.id == #resourceOwnerId")
public void updateResource(User user, Long resourceOwnerId) { ... }

@Value("#{${app.name} ?: 'DefaultApp'}")
private String appName;

@Value("#{@configService.getTimeout() ?: 5000}")
private int timeout;

// Chained Elvis
@Value("#{${primary.url} ?: ${fallback.url} ?: 'http://localhost'}")
private String serviceUrl;

// Role-based
@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(Long id) { ... }

// Authority-based
@PreAuthorize("hasAuthority('USER_DELETE')")
public void removeUser(Long id) { ... }

// Multiple roles
@PreAuthorize("hasAnyRole('ADMIN', 'MODERATOR')")
public void banUser(Long id) { ... }

// Access principal
@PreAuthorize("#username == principal.username")
public UserProfile getProfile(String username) { ... }

// Complex expression
@PreAuthorize("hasRole('ADMIN') or (#order.userId == principal.id)")
public void cancelOrder(Order order) { ... }

// Post-filter results
@PostFilter("filterObject.owner == principal.username")
public List<Document> getAllDocuments() { ... }

// #this in collection selection
@Value("#{numbers.?[#this > 5]}")
private List<Integer> greaterThanFive;

// #root for disambiguation
@Value("#{#root.systemProperties['os.name']}")
private String osName;

@Configuration
public class SpelConfig {

    @Bean
    public StandardEvaluationContext evaluationContext() {
        StandardEvaluationContext context = new StandardEvaluationContext();

        // Register static method as function
        context.registerFunction("reverseString",
            StringUtils.class.getDeclaredMethod("reverse", String.class));

        // Register variable
        context.setVariable("appVersion", "3.2.1");

        return context;
    }
}

// Usage
ExpressionParser parser = new SpelExpressionParser();
String reversed = parser.parseExpression(
    "#reverseString('hello')"
).getValue(context, String.class);  // "olleh"

@Component("auth")
public class AuthExpressions {

    public boolean isOwner(Long resourceId, Authentication authentication) {
        User user = (User) authentication.getPrincipal();
        return resourceRepository.findById(resourceId)
            .map(r -> r.getOwnerId().equals(user.getId()))
            .orElse(false);
    }
}

// Usage
@PreAuthorize("@auth.isOwner(#id, authentication)")
public void deleteResource(Long id) { ... }

// BAD -- parses on every call
public String evaluate(String input) {
    ExpressionParser parser = new SpelExpressionParser();
    return parser.parseExpression("'Hello ' + #name")
        .getValue(context, String.class);
}

// GOOD -- parse once, evaluate many
private static final ExpressionParser PARSER = new SpelExpressionParser();
private static final Expression GREETING_EXPR =
    PARSER.parseExpression("'Hello ' + #name");

public String evaluate(String name) {
    StandardEvaluationContext ctx = new StandardEvaluationContext();
    ctx.setVariable("name", name);
    return GREETING_EXPR.getValue(ctx, String.class);
}

// Attacker-controlled input
String userInput = "T(java.lang.Runtime).getRuntime().exec('rm -rf /')";

// Vulnerable code
ExpressionParser parser = new SpelExpressionParser();
Object result = parser.parseExpression(userInput).getValue();
// Server compromised

// WRONG -- user controls expression
parser.parseExpression(request.getParameter("filter")).getValue();

// RIGHT -- user provides values, you control the expression
context.setVariable("userFilter", request.getParameter("filter"));
parser.parseExpression("#users.?[name == #userFilter]").getValue(context);

// Restricts: no type references, no bean references, no constructors
SimpleEvaluationContext context = SimpleEvaluationContext
    .forReadOnlyDataBinding()
    .withInstanceMethods()
    .build();

// T(java.lang.Runtime) will FAIL in this context

private static final Set<String> ALLOWED_FIELDS =
    Set.of("name", "email", "age", "status");

public Object evaluateSafely(String field) {
    if (!ALLOWED_FIELDS.contains(field)) {
        throw new IllegalArgumentException("Field not allowed: " + field);
    }
    return parser.parseExpression(field).getValue(context);
}

// WRONG -- leaks internal structure
catch (SpelEvaluationException e) {
    return ResponseEntity.badRequest().body(e.getMessage());
}

// RIGHT -- generic error
catch (SpelEvaluationException e) {
    log.warn("SpEL evaluation failed", e);
    return ResponseEntity.badRequest().body("Invalid expression");
}