As noted in PR #4246 and issue #4216, the removal of withInstanceMethods() from SimpleEvaluationContext in DiscoveryClientRouteDefinitionLocator breaks path predicates that rely on standard String methods like replaceFirst().
Since withInstanceMethods() was intentionally removed to prevent SpEL injection security vulnerabilities, we cannot simply restore it.
Proposal:
We need to discuss a safer enhancement to allow users to format or manipulate serviceId strings in their predicates.
Possible alternatives:
- Provide a custom set of explicitly allowed SpEL functions (e.g.
#replaceFirst(target, regex, replacement)) registered directly in the StandardEvaluationContext or SimpleEvaluationContext specifically for common string manipulations.
- Introduce a new configuration property for
DiscoveryLocatorProperties such as serviceIdRegex and serviceIdReplacement to natively handle regex substitutions during route definition generation without relying on SpEL evaluation at all.
Would love to hear the maintainers' thoughts on which approach would be preferred or if there are other secure ways to support this functionality.
As noted in PR #4246 and issue #4216, the removal of
withInstanceMethods()fromSimpleEvaluationContextinDiscoveryClientRouteDefinitionLocatorbreaks path predicates that rely on standard String methods likereplaceFirst().Since
withInstanceMethods()was intentionally removed to prevent SpEL injection security vulnerabilities, we cannot simply restore it.Proposal:
We need to discuss a safer enhancement to allow users to format or manipulate
serviceIdstrings in their predicates.Possible alternatives:
#replaceFirst(target, regex, replacement)) registered directly in theStandardEvaluationContextorSimpleEvaluationContextspecifically for common string manipulations.DiscoveryLocatorPropertiessuch asserviceIdRegexandserviceIdReplacementto natively handle regex substitutions during route definition generation without relying on SpEL evaluation at all.Would love to hear the maintainers' thoughts on which approach would be preferred or if there are other secure ways to support this functionality.