SpringSource/spring-webflow-issues — pull request #5 by jmilkiewicz (2012-11-18 16:39:44+00:00)
Title: Reproducing SWF-1566

Hi

As suggested by Phil, this is a sample SWF project to reproduce issue SWF-1566.
Unfortunately i have no time to provide you an automated test to uncover the issue, since SWF testing machinery (AbstractXmlFlowExecutionTests) does not implement data binding: MockViewFactoryCreator#MockView#processUserEvent method has empty body so no data binding is performed.
Fortunately manual steps are deadly easy:
- start my example project
- go to server:port/SWF-1566/myflow.html
- fill any value in any inputs
- open firebug/chrome inspector
- modify index within any input name, like from elements[0].a to elements[10000].a
- click next
- on a page you should see that a given number of rows has been created- to reflect creation a dedicated bean for each row.

So as i stated in original jira issue: if malicious user modify your html page before data binding you could easily end up with a out-of-memory.

A previous approach to databinding (WebDataBinder) had an extra option to prevent this kind of situation: autoGrowCollectionLimit. Why not use the same/similar mechanism for https://github.com/SpringSource/spring-framework/blob/master/spring-expression/src/main/java/org/springframework/expression/spel/SpelParserConfiguration.java