Restricting Jakarta EL expressions to avoid RCE

SaferExpressionEvaluationWithJuel.java

void handle(HttpRequest request) {
    if (request.hasParameter("questionToBackend")) {
        String input = request.getParameter("questionToBackend"));
        String pattern = "(inside|outside)\\.(temperature|humidity)";
        if (!input.matches(pattern)) {
            throw new IllegalArgumentException("Unexpected expression");
        }
        String expression = "${" + input + "}";
        ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
        ELContext context = new de.odysseus.el.util.SimpleContext();
        ValueExpression e = factory.createValueExpression(context, expression, Object.class);
        Object object = e.getValue(context);
        handleResult(object);
    } else {
        callNextHandler(request);
    }
}