CVE-2021-28170

An attacker can supply an invalid EL expression that is not properly tokenized by the `ELParserTokenManager`, causing it to be evaluated as if it were valid. This is an expression language injection [CWE-917] where special delimiter characters (`$` and `#`) are not correctly neutralized. The attack vector is input-driven — any component that passes user-controlled strings into an EL evaluation context is potentially exploitable.

The bug resides in the `ELParserTokenManager` of the Jakarta Expression Language implementation (version 3.0.3 and earlier). The patch adds a new test class `EscalingTest` in the `org.glassfish.el.test` package that validates correct handling of escaped expression delimiters like `$${...}` and `$\#{...}`.

The patch introduces a test suite (`EscapingTest`) that verifies correct handling of escaped expression delimiters. For example, `$${1+1}` should evaluate to the literal string `$2` (the outer `$` is literal, the inner `${1+1}` is evaluated), and `$\${1+1}` should produce the literal `$${1+1}`. These tests confirm that the `ELParserTokenManager` now properly distinguishes escaped delimiters from actual expression start markers, closing the injection vector.