From c3819771c11a45eb5212c0a20c6db5015d20f29e Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Sun, 17 May 2026 11:50:25 +0800
Subject: [PATCH] refactor: allow extending property accessors and method
 resolvers when variable access is restricted

Remove the restriction that prevented custom property accessors and
method resolvers from being used when variableAccessRestricted is true.
The variable access restriction is already enforced at the variable
access level, so there is no security impact.
---
 .../spring5/expression/ThymeleafEvaluationContext.java      | 6 ------
 .../expression/ThymeleafEvaluationContextWrapper.java       | 6 ------
 .../spring6/expression/ThymeleafEvaluationContext.java      | 6 ------
 .../expression/ThymeleafEvaluationContextWrapper.java       | 6 ------
 4 files changed, 24 deletions(-)

diff --git a/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContext.java b/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContext.java
index 4183095c4..c810062b7 100755
--- a/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContext.java
+++ b/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContext.java
@@ -239,17 +239,11 @@ public List<ConstructorResolver> getConstructorResolvers() {
 
     @Override
     public List<MethodResolver> getMethodResolvers() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getMethodResolvers();
-        }
         return super.getMethodResolvers();
     }
 
     @Override
     public List<PropertyAccessor> getPropertyAccessors() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getPropertyAccessors();
-        }
         return super.getPropertyAccessors();
     }
 
diff --git a/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContextWrapper.java b/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContextWrapper.java
index 361f035b7..f24a9f4f0 100755
--- a/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContextWrapper.java
+++ b/lib/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/expression/ThymeleafEvaluationContextWrapper.java
@@ -149,16 +149,10 @@ public List<ConstructorResolver> getConstructorResolvers() {
     }
 
     public List<MethodResolver> getMethodResolvers() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getMethodResolvers();
-        }
         return this.methodResolvers == null ? this.delegate.getMethodResolvers() : this.methodResolvers;
     }
 
     public List<PropertyAccessor> getPropertyAccessors() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getPropertyAccessors();
-        }
         return this.propertyAccessors == null ? this.delegate.getPropertyAccessors() : this.propertyAccessors;
     }
 
diff --git a/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContext.java b/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContext.java
index 53ff4e1d7..c39c0de04 100755
--- a/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContext.java
+++ b/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContext.java
@@ -239,17 +239,11 @@ public List<ConstructorResolver> getConstructorResolvers() {
 
     @Override
     public List<MethodResolver> getMethodResolvers() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getMethodResolvers();
-        }
         return super.getMethodResolvers();
     }
 
     @Override
     public List<PropertyAccessor> getPropertyAccessors() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getPropertyAccessors();
-        }
         return super.getPropertyAccessors();
     }
 
diff --git a/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContextWrapper.java b/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContextWrapper.java
index 137de580b..8191b54d9 100755
--- a/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContextWrapper.java
+++ b/lib/thymeleaf-spring6/src/main/java/org/thymeleaf/spring6/expression/ThymeleafEvaluationContextWrapper.java
@@ -149,16 +149,10 @@ public List<ConstructorResolver> getConstructorResolvers() {
     }
 
     public List<MethodResolver> getMethodResolvers() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getMethodResolvers();
-        }
         return this.methodResolvers == null ? this.delegate.getMethodResolvers() : this.methodResolvers;
     }
 
     public List<PropertyAccessor> getPropertyAccessors() {
-        if (this.variableAccessRestricted) {
-            return this.restrictedModeContext.getPropertyAccessors();
-        }
         return this.propertyAccessors == null ? this.delegate.getPropertyAccessors() : this.propertyAccessors;
     }