Adds withAssignmentDisabled() to restrictive EvaluationContext.

Author: spencergibb

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/support/ShortcutConfigurable.java

@@ -21,6 +21,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;
 
 import org.springframework.beans.factory.BeanFactory;
@@ -30,6 +31,7 @@
 import org.springframework.expression.ConstructorResolver;
 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
+import org.springframework.expression.IndexAccessor;
 import org.springframework.expression.MethodResolver;
 import org.springframework.expression.OperatorOverloader;
 import org.springframework.expression.PropertyAccessor;
@@ -188,6 +190,7 @@ public GatewayEvaluationContext(BeanFactory beanFactory) {
 			if (restrictive) {
 				delegate = SimpleEvaluationContext.forPropertyAccessors(new RestrictivePropertyAccessor())
 					.withMethodResolvers((context, targetObject, name, argumentTypes) -> null)
+					.withAssignmentDisabled()
 					.build();
 			}
 			else {
@@ -252,6 +255,21 @@ public Object lookupVariable(String name) {
 			return delegate.lookupVariable(name);
 		}
 
+		@Override
+		public List<IndexAccessor> getIndexAccessors() {
+			return delegate.getIndexAccessors();
+		}
+
+		@Override
+		public TypedValue assignVariable(String name, Supplier<TypedValue> valueSupplier) {
+			return delegate.assignVariable(name, valueSupplier);
+		}
+
+		@Override
+		public boolean isAssignmentEnabled() {
+			return delegate.isAssignmentEnabled();
+		}
+
 	}
 
 	class RestrictivePropertyAccessor extends ReflectivePropertyAccessor {

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/support/ShortcutConfigurableTests.java

@@ -47,6 +47,23 @@ public class ShortcutConfigurableTests {
 
 	private SpelExpressionParser parser;
 
+	@Test
+	public void testNormalizeDefaultTypeWithSpelAssignmentAndInvalidInputFails() {
+		parser = new SpelExpressionParser();
+		ShortcutConfigurable shortcutConfigurable = new ShortcutConfigurable() {
+			@Override
+			public List<String> shortcutFieldOrder() {
+				return Arrays.asList("bean", "arg1");
+			}
+		};
+		Map<String, String> args = new HashMap<>();
+		args.put("bean", "#{ @myMap['my.flag'] = true}");
+		args.put("arg1", "val1");
+		assertThatThrownBy(() -> {
+			ShortcutType.DEFAULT.normalize(args, shortcutConfigurable, parser, this.beanFactory);
+		}).isInstanceOf(SpelEvaluationException.class);
+	}
+
 	@Test
 	public void testNormalizeDefaultTypeWithSpelAndInvalidInputFails() {
 		parser = new SpelExpressionParser();
@@ -221,6 +238,11 @@ public Bar bar() {
 			return new Bar();
 		}
 
+		@Bean
+		public Map<String, Object> myMap() {
+			return new HashMap<>();
+		}
+
 	}
 
 	protected static class Bar {