Rule Definition
The software constructs all or part of an expression language statement via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, a user may execute unauthorized commands.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

// Example using Spring Expression Language
String taintedInput = request.getParameter("expr");
SpelExpressionParser parser = new SpelExpressionParser();
SpelExpression expression = parser.parseRaw(taintedInput);

Fixed Code Sample

// Example using Spring Expression Language
SpelExpressionParser parser = new SpelExpressionParser();
SpelExpression expression = parser.parseRaw(hardCodedInput);

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') https://cwe.mitre.org/data/definitions/917.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection