SpEL Malformed Delimiters
ID |
java.spring_spel_malformed_delimiters |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
reliability, spring |
Description
Reports a string literal annotation argument containing a Spring Expression Language block (#{…}) or a property placeholder (${…}) whose delimiters are not well-formed: an unbalanced {}, [] or (), or a quote that is opened but never closed.
Rationale
Only Spring, not the Java compiler, parses this syntax — it lives inside an ordinary string literal, so javac accepts it unconditionally. A malformed block either throws when Spring resolves it at startup, or, worse, silently falls back to the literal text with no error raised anywhere.
This rule checks delimiter well-formedness only; it is not a full SpEL parser. A missing operator, an unknown identifier, an invalid numeric literal, or any other error that needs SpEL grammar knowledge to judge is a semantic question and is explicitly out of scope.
// Bad - the '[' is never closed
@Value("#{systemEnvironment['deploy.region'}")
private String deployRegion;
// Bad - the '#{' itself is never closed
@Value("#{systemEnvironment['deploy.zone']")
private String deployZone;Remediation
Close every bracket and quote the block opens.
@Value("#{systemEnvironment['deploy.region']}")
private String deployRegion;