Ensure MapAccessor#canWrite only returns true for a Map target

Closes gh-33265

Author: sbrannen

spring-context/src/main/java/org/springframework/context/expression/MapAccessor.java

@@ -81,7 +81,7 @@ public TypedValue read(EvaluationContext context, @Nullable Object target, Strin
 
 	@Override
 	public boolean canWrite(EvaluationContext context, @Nullable Object target, String name) throws AccessException {
-		return this.allowWrite;
+		return (this.allowWrite && target instanceof Map);
 	}
 
 	@Override

spring-context/src/test/java/org/springframework/context/expression/MapAccessorTests.java

@@ -81,6 +81,22 @@ void compilationSupport() {
 		assertThat(ex.getValue(sec, testMap)).isEqualTo("bar2");
 	}
 
+	@Test
+	void canWrite() throws Exception {
+		StandardEvaluationContext context = new StandardEvaluationContext();
+		Map<String, Object> testMap = getSimpleTestMap();
+
+		MapAccessor mapAccessor = new MapAccessor();
+		assertThat(mapAccessor.canWrite(context, new Object(), "foo")).isFalse();
+		assertThat(mapAccessor.canWrite(context, testMap, "foo")).isTrue();
+		// Cannot actually write to an immutable Map, but MapAccessor cannot easily check for that.
+		assertThat(mapAccessor.canWrite(context, Map.of(), "x")).isTrue();
+
+		mapAccessor = new MapAccessor(false);
+		assertThat(mapAccessor.canWrite(context, new Object(), "foo")).isFalse();
+		assertThat(mapAccessor.canWrite(context, testMap, "foo")).isFalse();
+	}
+
 	@Test
 	void isWritable() {
 		Map<String, Object> testMap = getSimpleTestMap();