[jira] [Comment Edited] (UNOMI-399) Default allow-list for expression filter not properly loaded from config

["Kevan Jahanshahi (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/UNOMI-399?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17232704#comment-17232704 ] 

Kevan Jahanshahi edited comment on UNOMI-399 at 11/16/20, 11:48 AM:
--------------------------------------------------------------------

Finally we have an other issue, the script can contains: 
{code:java}
}{code}
this is closing the env placeholder prematurely 
{code:java}
${env:UNOMI_SCRIPTING_FILTER_MVEL_ALLOW:-}{code}
We need to load the scripts from files and not from the config directly.

Working a on PR right now


was (Author: jkevan):
Finally we have an other issue, the script can contains: 
{code:java}
}{code}
this is closing the env placeholder prematurely 
${env:UNOMI_SCRIPTING_FILTER_MVEL_ALLOW:-}
We need to load the scripts from files and not from the config directly.

Working a on PR right now

> Default allow-list for expression filter not properly loaded from config
> ------------------------------------------------------------------------
>
>                 Key: UNOMI-399
>                 URL: https://issues.apache.org/jira/browse/UNOMI-399
>             Project: Apache Unomi
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 1.5.2, 1.5.3
>            Reporter: Serge Huber
>            Priority: Major
>             Fix For: 1.5.4
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> In custom.system.properties we can customize the list of allowed expression as in the following example:
> {code}
> org.apache.unomi.scripting.filter.mvel.allow=${env:UNOMI_SCRIPTING_FILTER_MVEL_ALLOW:-\
>   \\Q'systemProperties.campaigns.'+campaignId+'Engaged'\\E,\
>   \\Q'properties.pageViewCount.' + (scope != null ? scope : 'defaultSiteKey')\\E,\
>   \\Q'properties.interests.'+ (interestName != null ? interestName.toLowerCase() : 'default')\\E,\
>   \\Qevent.properties['src_languages.values'] != null ? event.properties['src_languages.values'].toLowerCase() : 'en'\\E,\
>   \\Qevent.properties['src_terms[0].term'] != null ? event.properties['src_terms[0].term'].toLowerCase() : ''\\E,\
>   \\Qr = profile.properties['interests']; foreach(interest : event.target.properties['interests'].entrySet()) { if (r == null) { r = [interest.key: interest.value] } else if (r[interest.key] != null) { r[interest.key] = r[interest.key] + interest.value } else { r[interest.key] = interest.value } } r\\E,\
>   \\Qr = profile.properties['pageViewCount']; if (r == null) { profile.properties['pageViewCount'] = []; profile.properties.pageViewCount = [event.scope : 1] } else { if (r[event.scope] != null) { r[event.scope] = r[event.scope] + 1 } else { r[event.scope] = 1 }} r\\E,\
>   \\Qevent.properties['src_terms[0].term'].toLowerCase()\\E}
> {code}
> Unfortunately due to a bug in the loading code this list is not properly loaded. 
> However JSON files coming from bundles are properly managed so as a workaround a bundle can be used to populate the list.
> Also there is a bug in the ScriptExecutor for MVEL that returns the script instead of NULL when the script is filtered out.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)