Improper Control of Generation of Code ('Code Injection')

abstract class SpelView(val template: String) extends View {
  var resolver: PlaceholderResolver
  final private val parser = new SpelExpressionParser()
  final private val context = new StandardEvaluationContext()

  this.context.addPropertyAccessor(new MapAccessor())
  this.resolver = (name: String) => {
      // VULNERABLE: Improper Control of Generation of Code ('Code Injection')
      val expression = parser.parseExpression(name) //BOOM!
      val value = expression.getValue(context)
      null
  }
  override def getContentType = "text/html"

  @throws[Exception]
  def render(model: java.util.Map[String, _], request: HttpServletRequest, response: HttpServletResponse): Unit = {
    val path = ServletUriComponentsBuilder.fromContextPath(request).build.getPath
    context.setRootObject(model)
    val helper = new PropertyPlaceholderHelper("${", "}")
    val result = helper.replacePlaceholders(template, resolver)
    response.setContentType(getContentType)
    response.getWriter.append(result)
  }
}