Skip to content

Commit 9772eb8

Browse files
committed
Deprecated Spring's own JSP expression evaluation
Since web applications declaring a Servlet 2.3 web.xml become really rare now, we're finally deprecating Spring's own ExpressionEvaluationUtils class. As a consequence, we're also setting "springJspExpressionSupport" to false by default, avoiding the potential double EL evaluation problem on pre-Servlet-3.0 containers. Issue: SPR-5308
1 parent c368068 commit 9772eb8

File tree

1 file changed

+12
-13
lines changed

1 file changed

+12
-13
lines changed

spring-web/src/main/java/org/springframework/web/util/ExpressionEvaluationUtils.java

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2011 the original author or authors.
2+
* Copyright 2002-2012 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -39,7 +39,10 @@
3939
* @author Alef Arendsen
4040
* @since 11.07.2003
4141
* @see javax.servlet.jsp.el.ExpressionEvaluator#evaluate
42+
* @deprecated as of Spring 3.2, in favor of the JSP 2.0+ native support
43+
* for embedded expressions in JSP pages (also applying to tag attributes)
4244
*/
45+
@Deprecated
4346
public abstract class ExpressionEvaluationUtils {
4447

4548
/**
@@ -64,13 +67,9 @@ public abstract class ExpressionEvaluationUtils {
6467
* containers with web applications declaring Servlet 2.4 or higher in their
6568
* <code>web.xml</code>. For backwards compatibility, Spring's expression support
6669
* will remain active for applications declaring Servlet 2.3 or earlier. However,
67-
* on Servlet 2.4/2.5 containers, we can't find out what the application has declared,
68-
* so we'll also fall back to keeping expression support active in such a case.
69-
* <p><b>Recommendations:</b> Explicitly set "springJspExpressionSupport" to "false"
70-
* in order to prevent double evaluation for Servlet 2.4+ based applications.
71-
* On Servlet 3.0 containers, this will be done for you by default by the framework.
72-
* If for some reason you nevertheless want Spring's JSP expression support to be
73-
* active, explicitly set the "springJspExpressionSupport" context-param to "true".
70+
* on Servlet 2.4/2.5 containers, we can't find out what the application has declared;
71+
* as of Spring 3.2, we won't activate Spring's expression support at all then since
72+
* it got deprecated and will be removed in the next iteration of the framework.
7473
* @param pageContext current JSP PageContext
7574
* @return <code>true</code> if active (ExpressionEvaluationUtils will actually evaluate expressions);
7675
* <code>false</code> if not active (ExpressionEvaluationUtils will return given values as-is,
@@ -84,13 +83,13 @@ public static boolean isSpringJspExpressionSupportActive(PageContext pageContext
8483
}
8584
if (sc.getMajorVersion() >= 3) {
8685
// We're on a Servlet 3.0+ container: Let's check what the application declares...
87-
if (sc.getEffectiveMajorVersion() > 2 || sc.getEffectiveMinorVersion() > 3) {
88-
// Application declares Servlet 2.4+ in its web.xml: JSP 2.0 expressions active.
89-
// Skip our own expression support in order to prevent double evaluation.
90-
return false;
86+
if (sc.getEffectiveMajorVersion() == 2 && sc.getEffectiveMinorVersion() < 4) {
87+
// Application declares Servlet 2.3- in its web.xml: JSP 2.0 expressions not active.
88+
// Activate our own expression support.
89+
return true;
9190
}
9291
}
93-
return true;
92+
return false;
9493
}
9594

9695
/**

0 commit comments

Comments
 (0)