USPR-13800: enforce patched spring-expression version (GHSA-r5w3-xv2f-j59q)

build.gradle

@@ -23,6 +23,8 @@ allprojects {
 }
 
 subprojects {
+    def springExpressionMinVersion = '7.0.8'
+
     configurations.configureEach {
         resolutionStrategy.eachDependency {
             if (requested.group == 'tools.jackson.core'
@@ -58,6 +60,12 @@ subprojects {
                         'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
                         'after maxHeaderSize truncation, fixed in 4.2.16.Final')
             }
+            if (requested.group == 'org.springframework' && requested.name == 'spring-expression'
+                    && requested.version != null && requested.version < springExpressionMinVersion) {
+                useVersion(springExpressionMinVersion)
+                because('GHSA-r5w3-xv2f-j59q: Spring Expression Language (SpEL) Algorithmic Denial of Service ' +
+                        'via crafted expressions causing excessive resource consumption, fixed in ' + springExpressionMinVersion)
+            }
         }
     }
 
@@ -118,4 +126,23 @@ subprojects {
         consoleOutput = true
         ruleSets = ["$rootDir/ruleset.xml"]
     }
+
+    tasks.register('verifySpringExpressionVersion') {
+        doLast {
+            configurations.findAll { it.canBeResolved }.each { config ->
+                config.incoming.resolutionResult.allDependencies.each { dep ->
+                    if (dep instanceof org.gradle.api.artifacts.result.ResolvedDependencyResult) {
+                        def id = dep.selected.moduleVersion
+                        if (id != null && id.group == 'org.springframework' && id.name == 'spring-expression'
+                                && id.version < springExpressionMinVersion) {
+                            throw new GradleException("org.springframework:spring-expression resolved to ${id.version} in configuration ${config.name}, but must be >= ${springExpressionMinVersion} (GHSA-r5w3-xv2f-j59q)")
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    tasks.named('test') { dependsOn tasks.named('verifySpringExpressionVersion') }
+    tasks.named('check') { dependsOn tasks.named('verifySpringExpressionVersion') }
 }

examples/example-spring-boot-starter-web/build.gradle

@@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5'
 ext['logback.version'] = '1.5.34'
 ext['netty.version'] = '4.2.16.Final'
 ext['tomcat.version'] = '11.0.22'
+ext['spring-framework.version'] = '7.0.8'
 
 dependencies {
     implementation project(':examples:examples-common')

examples/example-spring-boot-starter-webflux/build.gradle

@@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5'
 ext['logback.version'] = '1.5.34'
 ext['netty.version'] = '4.2.16.Final'
 ext['tomcat.version'] = '11.0.22'
+ext['spring-framework.version'] = '7.0.8'
 
 dependencies {
     implementation project(':examples:examples-common')