【Type:feature 】The SPEL in the mock plugin is secure by default

[li-keguo]

work list:

• Use SimpleEvaluationContext as the default secure SPEL.
• Provides a Standard Expression Generator, which is not loaded by default.

[tian-pengfei]

Well done! maybe SimpleEvaluationContextcan completely replace old one . I think we can remove old one. Have you ever try MethodSecurityEvaluationContext. are threre any differences between SimpleEvaluationContext and MethodSecurityEvaluationContext?

[codecov-commenter]

Codecov Report

Merging #4606 (62b7808) into master (ba6f3a3) will increase coverage by 0.00%.
The diff coverage is 63.15%.

@@            Coverage Diff            @@
##             master    #4606   +/-   ##
=========================================
  Coverage     68.87%   68.87%           
- Complexity     7822     7835   +13     
=========================================
  Files          1039     1041    +2     
  Lines         30034    30058   +24     
  Branches       2739     2739           
=========================================
+ Hits          20685    20703   +18     
- Misses         7728     7734    +6     
  Partials       1621     1621           

Impacted Files	Coverage Δ
...java/org/apache/shenyu/plugin/mock/MockPlugin.java	0.00% <0.00%> (ø)
.../shenyu/plugin/mock/handler/MockPluginHandler.java	0.00% <0.00%> (ø)
...a/org/apache/shenyu/plugin/mock/util/MockUtil.java	80.00% <66.66%> (+0.40%)	⬆️
...in/mock/generator/StandardExpressionGenerator.java	85.71% <85.71%> (ø)
...shenyu/plugin/mock/util/EvaluationContextUtil.java	89.47% <89.47%> (ø)
...nyu/plugin/mock/generator/ExpressionGenerator.java	100.00% <100.00%> (+10.00%)	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[li-keguo]

Well done! maybe SimpleEvaluationContext can completely replace old one . I think we can remove old one. Have you ever try MethodSecurityEvaluationContext. are threre any differences between SimpleEvaluationContext and MethodSecurityEvaluationContext?

The original has been replaced with a secure implementation. see https://docs.spring.io/spring-framework/docs/5.0.6.RELEASE/javadoc-api/org/springframework/expression/spel/support/SimpleEvaluationContext.html

StandardExpressionGenerator is not loaded by default and needs to be enabled by the user.

Without studying the MethodSecurityEvaluationContext, but only providing some clues, he came from spring-security.