cwe-917-expression-language-injection

To fix Expression Language Injection vulnerabilities in Spring, replace `StandardEvaluationContext` with `SimpleEvaluationContext` and restrict expression parsing to secure dynamic evaluation.

Expression Language Injection is a security vulnerability where attackers manipulate dynamic expression evaluation, which is remediated by adopting secure coding practices like using `SimpleEvaluationContext` over `StandardEvaluationContext`.

You should use `SimpleEvaluationContext` instead of `StandardEvaluationContext` to restrict expression parsing capabilities, providing deterministic remediation for CWE-917 and preventing unauthorized code execution.

Yes, this remediation applies to Spring SpEL usage across controller, service, and repository layers, ensuring secure coding practices for dynamic expression evaluation throughout your Java application architecture.

When a SAST tool flags an Expression Language Injection vulnerability, apply this secure coding pattern to replace vulnerable contexts and restrict dynamic expression evaluation in your Spring application.