Hi
Is there any way i could set a limit on collection size which elements has been set by SPEL?
I am using Spring WebFlow, but my problem is more into the way SPEL binds form parameters to form beans properties:
Since i do not know in advance the target size of funds (i only know the upper limit ) i have set SpelParserConfiguration#autoGrowCollections to true to have list expanded as necessary.Code:public class InitialFundsFormBean implements Serializable { @Valid private List<InitialFundBean> funds = new LinkedList<InitialFundBean>(); ... } public class InitialFundBean implements Serializable{ private Long id; private String share; }
Unfortunately malicious user can edit HTML page and set very large index on particular input like: "funds[100000000].id" which will cause Spring to insert 100000000 InitialFundBean object into funds list . Is there any way i could set max size of target array/max index of element to put ?
Before SpEL was used for binding, DataBinder (more specifically WebDataBinder) was used which has an option to set autoGrowCollectionLimit. Why autoGrowCollectionLimit is missing for SpelParserConfiguration?
br Jakub


Reply With Quote