whitelabel error page vulnerability

[girtsn]

Hello.
There is an SPEL injection problem (would consider it vulnerability) with whitelabel error page.
If encountering an error message that shows the used value (e.g. type conversion between string and a boolean) and the used value contains SPEL expression, it will be evaluated server side.
I know, the recommendation is to disable the whitelabel, but I suppose this should still get fixed.

[wilkinsona]

@girtsn This is the repository for sample projects that reproduce issues reported against Spring Boot. To report an issue with Spring Boot itself, please open an issue here. If you do so, can you please provide a concrete example of the problem?

[girtsn]

Thanks for the advise, created spring-projects/spring-boot#4763