You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by he...@apache.org on 2019/05/13 16:42:42 UTC
[commons-jexl] branch master updated: JEXL-253: refined logic to
find inheritable permissions, added test
This is an automated email from the ASF dual-hosted git repository.
henrib pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-jexl.git
The following commit(s) were added to refs/heads/master by this push:
new 0d131f4 JEXL-253: refined logic to find inheritable permissions, added test
0d131f4 is described below
commit 0d131f4787b3975035847653b8983eb8ba18fcf4
Author: henrib <he...@apache.org>
AuthorDate: Mon May 13 18:42:11 2019 +0200
JEXL-253: refined logic to find inheritable permissions, added test
---
.../commons/jexl3/introspection/JexlSandbox.java | 24 ++++++++++---
.../commons/jexl3/introspection/SandboxTest.java | 42 ++++++++++++++++++++++
2 files changed, 61 insertions(+), 5 deletions(-)
diff --git a/src/main/java/org/apache/commons/jexl3/introspection/JexlSandbox.java b/src/main/java/org/apache/commons/jexl3/introspection/JexlSandbox.java
index ff767f2..fecacb7 100644
--- a/src/main/java/org/apache/commons/jexl3/introspection/JexlSandbox.java
+++ b/src/main/java/org/apache/commons/jexl3/introspection/JexlSandbox.java
@@ -569,18 +569,32 @@ public final class JexlSandbox {
* @param clazz the class
* @return the permissions
*/
+ @SuppressWarnings("null") // clazz can not be null since permissions would be not null and black;
public Permissions get(Class<?> clazz) {
- Permissions permissions = clazz == null? ALL_BLACK : sandbox.get(clazz.getName());
+ Permissions permissions = clazz == null ? ALL_BLACK : sandbox.get(clazz.getName());
if (permissions == null) {
if (inherit) {
- // clazz can not be null since permissions would be not null and black;
- // find first inheritable class that defined permissions
- for (Class<?> ii : clazz.getClasses()) {
- permissions = sandbox.get(ii.getName());
+ // find first inherited interface that defines permissions
+ for (Class<?> inter : clazz.getInterfaces()) {
+ permissions = sandbox.get(inter.getName());
if (permissions != null && permissions.isInheritable()) {
break;
}
}
+ // nothing defined yet, find first superclass that defines permissions
+ if (permissions == null) {
+ // lets walk all super classes
+ Class<?> zuper = clazz.getSuperclass();
+ // walk all superclasses
+ while (zuper != null) {
+ permissions = sandbox.get(zuper.getName());
+ if (permissions != null && permissions.isInheritable()) {
+ break;
+ }
+ zuper = zuper.getSuperclass();
+ }
+ }
+ // nothing was inheritable
if (permissions == null) {
permissions = white ? ALL_WHITE : ALL_BLACK;
}
diff --git a/src/test/java/org/apache/commons/jexl3/introspection/SandboxTest.java b/src/test/java/org/apache/commons/jexl3/introspection/SandboxTest.java
index 82eeae3..2f5f063 100644
--- a/src/test/java/org/apache/commons/jexl3/introspection/SandboxTest.java
+++ b/src/test/java/org/apache/commons/jexl3/introspection/SandboxTest.java
@@ -16,6 +16,10 @@
*/
package org.apache.commons.jexl3.introspection;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
import org.apache.commons.jexl3.JexlBuilder;
import org.apache.commons.jexl3.JexlContext;
import org.apache.commons.jexl3.JexlEngine;
@@ -67,6 +71,10 @@ public class SandboxTest extends JexlTestCase {
public void callMeNot() {
throw new RuntimeException("should not be callable!");
}
+
+ public String allowInherit() {
+ return "this is allowed";
+ }
}
public static class Foo extends CallMeNot implements CantCallMe, TryCallMe {
@@ -374,4 +382,38 @@ public class SandboxTest extends JexlTestCase {
result = script.execute(context);
Assert.assertNotNull(result);
}
+
+ @Test
+ public void testSandboxInherit() throws Exception {
+ Object result;
+ JexlContext ctxt = null;
+ Map<String, JexlSandbox.Permissions> perms = new HashMap<String, JexlSandbox.Permissions>();
+ List<String> foo = new ArrayList<String>();
+ JexlSandbox sandbox = new JexlSandbox(false, true, perms);
+ sandbox.white(java.util.List.class.getName());
+ //sandbox.black(Foo.class.getName()).execute();
+ JexlEngine sjexl = new JexlBuilder().sandbox(sandbox).strict(true).create();
+ JexlScript method = sjexl.createScript("foo.add(y)", "foo", "y");
+ JexlScript set = sjexl.createScript("foo[x] = y", "foo", "x", "y");
+ JexlScript get = sjexl.createScript("foo[x]", "foo", "x");
+ try {
+ result = method.execute(ctxt, foo, "nothing");
+ Assert.assertEquals(true, result);
+ result = null;
+ result = get.execute(null, foo, 0);
+ Assert.assertEquals("nothing", result);
+ result = null;
+ result = set.execute(null, foo, 0, "42");
+ Assert.assertEquals("42", result);
+
+ result = null;
+ result = get.execute(null, foo, 0);
+ Assert.assertEquals("42", result);
+ //Assert.fail("should have not been possible");
+ } catch (JexlException xjm) {
+ // ok
+ LOGGER.info(xjm.toString());
+ }
+
+ }
}