You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2026/06/28 22:51:59 UTC
(commons-jexl) branch master updated (07299eba -> 66ae9f40)
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/commons-jexl.git
from 07299eba Use final
new 9211b29a Use final.
new 66ae9f40 Prepare for the next release candidate
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
README.md | 4 +-
RELEASE-NOTES.txt | 48 ++++++-----------
src/changes/changes.xml | 2 +-
.../jexl3/internal/introspection/Permissions.java | 63 +++++++---------------
src/site/xdoc/download_jexl.xml | 26 ++++-----
5 files changed, 53 insertions(+), 90 deletions(-)
(commons-jexl) 02/02: Prepare for the next release candidate
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-jexl.git
commit 66ae9f406de8b60a02ca2dad87b1fb7329ee8740
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Sun Jun 28 22:51:53 2026 +0000
Prepare for the next release candidate
---
README.md | 4 ++--
RELEASE-NOTES.txt | 48 +++++++++++++++--------------------------
src/changes/changes.xml | 2 +-
src/site/xdoc/download_jexl.xml | 26 +++++++++++-----------
4 files changed, 33 insertions(+), 47 deletions(-)
diff --git a/README.md b/README.md
index b3fa8f4b..954c1c34 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Apache Commons JEXL
[](https://github.com/apache/commons-jexl/actions/workflows/maven.yml)
[](https://search.maven.org/artifact/org.apache.commons/commons-jexl3)
-[](https://javadoc.io/doc/org.apache.commons/commons-jexl3/3.6.4)
+[](https://javadoc.io/doc/org.apache.commons/commons-jexl3/3.7.0)
[](https://github.com/apache/commons-jexl/actions/workflows/codeql-analysis.yml)
[](https://api.securityscorecards.dev/projects/github.com/apache/commons-jexl)
@@ -68,7 +68,7 @@ Alternatively, you can pull it from the central Maven repositories:
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-jexl3</artifactId>
- <version>3.6.4</version>
+ <version>3.7.0</version>
</dependency>
```
diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt
index a1eebf3d..f3ea8178 100644
--- a/RELEASE-NOTES.txt
+++ b/RELEASE-NOTES.txt
@@ -1,33 +1,29 @@
Apache Commons JEXL 3.7.0 Release Notes
-========================================
+---------------------------------------
The Apache Commons JEXL team is pleased to announce the release of Apache Commons JEXL 3.7.0.
Introduction
-============
+------------
-Apache Commons JEXL is a library that enables scripting features in Java applications and frameworks.
+Apache Commons JEXL is a library that enables scripting features in Java applications and frameworks..
This is a feature and maintenance release. Java 8 or later is required.
Compatibility with previous releases
-=====================================
-
-Version 3.7.0 is source and binary compatible with 3.6.x but changes default runtime and
-parse-time behavior (see below).
+------------------------------------
+Version 3.7.0 is source and binary compatible with 3.6.x but changes the default runtime and parse-time behavior (see below).
-Breaking change in 3.7.0
-=========================
+Behavior breaking change in 3.7.0
+---------------------------------
-Two defaults change:
+o The default permissions is now "SECURE": a minimum allow-list covering only safe java.lang
+ value types, java.math, and java.util. Everything else is denied unless explicitly composed in.
- o The default permissions become SECURE — a minimum allow-list covering only safe java.lang
- value types, java.math, and java.util. Everything else is denied unless explicitly composed in.
-
- o The default features disable new(...), global side-effects, pragmas, and annotations, and enable
- lexical scoping; loops remain available to scripts (but never to expressions). Scripts using a
- disabled construct will throw JexlException.Feature at parse time with the default engine.
+o The default features disable new(...), global side-effects, pragmas, and annotations, and enable
+ lexical scoping; loops remain available to scripts (but never to expressions). Scripts using a
+ disabled construct will throw JexlException.Feature at parse time with the default engine.
To restore the previous (3.6.x) defaults, load the bundled jexl.yaml via JexlConfigLoader:
@@ -37,23 +33,12 @@ To restore the previous (3.6.x) defaults, load the bundled jexl.yaml via JexlCon
Use JexlPermissions.logging() to discover which reflective elements the new algorithm denies.
-
New features
-============
-
-o JEXL-465: Add JexlConfigLoader to build a JexlEngine from a YAML configuration (permissions,
- features, arithmetic, namespaces, imports).
-o JEXL-464: Default permissions are SECURE and default features harden parse-time behavior
- (disable new, global side-effects, pragmas and annotations; enable lexical scoping;
- loops remain available to scripts).
-o JEXL-463: Add JexlPermissions.logging() to wrap a permission set and log which reflective
- elements are allowed or denied.
-
-
-Fixed Bugs
-==========
+------------
-o JEXL-462: JexlPermissions.RESTRICTED must ensure a better level of isolation.
+o JEXL-465: Add JexlConfigLoader to build a JexlEngine from a YAML configuration (permissions, features, arithmetic, namespaces, imports).
+o JEXL-464: Default permissions are SECURE and default features harden parse-time behavior (disable new, global side-effects, pragmas and annotations; enable lexical scoping; loops remain available to scripts).
+o JEXL-463: Add JexlPermissions.logging() to wrap a permission set and log which reflective elements are allowed or denied.
Historical list of changes: https://commons.apache.org/proper/commons-jexl/changes.html
@@ -68,6 +53,7 @@ Download page: https://commons.apache.org/proper/commons-jexl/download_jexl.cgi
Have fun!
-Apache Commons Team
+------------------------------------------------------------------------------
Apache Commons JEXL 3.6.4 Release Notes
---------------------------------------
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index d04a5a9d..e7b91a54 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -27,7 +27,7 @@
<author email="dev@commons.apache.org">Commons Developers</author>
</properties>
<body>
- <release version="3.7.0" date="YYYY-MM-DD" description="This is a feature and maintenance release. Java 8 or later is required.">
+ <release version="3.7.0" date="2026-06-28" description="This is a feature and maintenance release. Java 8 or later is required.">
<!-- ADD -->
<action dev="henrib" type="add" issue="JEXL-465">Add JexlConfigLoader to build a JexlEngine from a YAML configuration (permissions, features, arithmetic, namespaces, imports).</action>
<action dev="henrib" type="add" issue="JEXL-464">Default permissions are SECURE and default features harden parse-time behavior (disable new, global side-effects, pragmas and annotations; enable lexical scoping; loops remain available to scripts).</action>
diff --git a/src/site/xdoc/download_jexl.xml b/src/site/xdoc/download_jexl.xml
index 2470c589..29ee2a09 100644
--- a/src/site/xdoc/download_jexl.xml
+++ b/src/site/xdoc/download_jexl.xml
@@ -115,32 +115,32 @@ limitations under the License.
</p>
</subsection>
</section>
- <section name="Apache Commons JEXL 3.6.4 ">
+ <section name="Apache Commons JEXL 3.7.0 ">
<subsection name="Binaries">
<table>
<tr>
- <td><a href="[preferred]/commons/jexl/binaries/commons-jexl-3.6.4-bin.tar.gz">commons-jexl-3.6.4-bin.tar.gz</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.6.4-bin.tar.gz.sha512">sha512</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.6.4-bin.tar.gz.asc">pgp</a></td>
+ <td><a href="[preferred]/commons/jexl/binaries/commons-jexl-3.7.0-bin.tar.gz">commons-jexl-3.7.0-bin.tar.gz</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.7.0-bin.tar.gz.sha512">sha512</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.7.0-bin.tar.gz.asc">pgp</a></td>
</tr>
<tr>
- <td><a href="[preferred]/commons/jexl/binaries/commons-jexl-3.6.4-bin.zip">commons-jexl-3.6.4-bin.zip</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.6.4-bin.zip.sha512">sha512</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.6.4-bin.zip.asc">pgp</a></td>
+ <td><a href="[preferred]/commons/jexl/binaries/commons-jexl-3.7.0-bin.zip">commons-jexl-3.7.0-bin.zip</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.7.0-bin.zip.sha512">sha512</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/binaries/commons-jexl-3.7.0-bin.zip.asc">pgp</a></td>
</tr>
</table>
</subsection>
<subsection name="Source">
<table>
<tr>
- <td><a href="[preferred]/commons/jexl/source/commons-jexl-3.6.4-src.tar.gz">commons-jexl-3.6.4-src.tar.gz</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.6.4-src.tar.gz.sha512">sha512</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.6.4-src.tar.gz.asc">pgp</a></td>
+ <td><a href="[preferred]/commons/jexl/source/commons-jexl-3.7.0-src.tar.gz">commons-jexl-3.7.0-src.tar.gz</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.7.0-src.tar.gz.sha512">sha512</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.7.0-src.tar.gz.asc">pgp</a></td>
</tr>
<tr>
- <td><a href="[preferred]/commons/jexl/source/commons-jexl-3.6.4-src.zip">commons-jexl-3.6.4-src.zip</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.6.4-src.zip.sha512">sha512</a></td>
- <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.6.4-src.zip.asc">pgp</a></td>
+ <td><a href="[preferred]/commons/jexl/source/commons-jexl-3.7.0-src.zip">commons-jexl-3.7.0-src.zip</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.7.0-src.zip.sha512">sha512</a></td>
+ <td><a href="https://downloads.apache.org/commons/jexl/source/commons-jexl-3.7.0-src.zip.asc">pgp</a></td>
</tr>
</table>
</subsection>
(commons-jexl) 01/02: Use final.
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-jexl.git
commit 9211b29ab3fdd593a9a51f9093c62a6906b03405
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Sun Jun 28 22:42:12 2026 +0000
Use final.
- Remove trailing whitespace.
- Better local variable name.
---
.../jexl3/internal/introspection/Permissions.java | 63 +++++++---------------
1 file changed, 20 insertions(+), 43 deletions(-)
diff --git a/src/main/java/org/apache/commons/jexl3/internal/introspection/Permissions.java b/src/main/java/org/apache/commons/jexl3/internal/introspection/Permissions.java
index f204e421..91a240d5 100644
--- a/src/main/java/org/apache/commons/jexl3/internal/introspection/Permissions.java
+++ b/src/main/java/org/apache/commons/jexl3/internal/introspection/Permissions.java
@@ -70,12 +70,12 @@ public class Permissions implements JexlPermissions {
* @return the copy of the map
* @param <T> the type of Copyable values
*/
- static <T extends Copyable<T>> Map<String, T> copyMap(Map<String, T> map) {
- Map<String, T> njc = new HashMap<>(map.size());
- for(Map.Entry<String, T> entry : map.entrySet()) {
- njc.put(entry.getKey(), entry.getValue().copy());
+ static <T extends Copyable<T>> Map<String, T> copyMap(final Map<String, T> map) {
+ final Map<String, T> copy = new HashMap<>(map.size());
+ for (final Map.Entry<String, T> entry : map.entrySet()) {
+ copy.put(entry.getKey(), entry.getValue().copy());
}
- return njc;
+ return copy;
}
/**
@@ -96,7 +96,7 @@ public class Permissions implements JexlPermissions {
methodNames = methods;
fieldNames = fields;
}
-
+
@Override public NoJexlClass copy() {
return new NoJexlClass(new HashSet<>(methodNames), new HashSet<>(fieldNames));
}
@@ -131,11 +131,10 @@ public class Permissions implements JexlPermissions {
* <p>Field or method that are named are the only one allowed access.</p>
*/
static class JexlClass extends NoJexlClass {
- JexlClass(Set<String> methods, Set<String> fields) {
+ JexlClass(final Set<String> methods, final Set<String> fields) {
super(methods, fields);
}
JexlClass() {
- super();
}
@Override public JexlClass copy() {
return new JexlClass(new HashSet<>(methodNames), new HashSet<>(fieldNames));
@@ -155,7 +154,6 @@ public class Permissions implements JexlPermissions {
*/
static class AllowedNoJexlClass extends NoJexlClass {
AllowedNoJexlClass() {
- super();
}
AllowedNoJexlClass(final Set<String> methods, final Set<String> fields) {
super(methods, fields);
@@ -236,13 +234,13 @@ public class Permissions implements JexlPermissions {
* A package where classes are allowed by default.
*/
static class JexlPackage extends NoJexlPackage {
- JexlPackage(Map<String, NoJexlClass> map) {
+ JexlPackage(final Map<String, NoJexlClass> map) {
super(map);
}
@Override
NoJexlClass getNoJexl(final Class<?> clazz) {
- NoJexlClass njc = nojexl.get(classKey(clazz));
+ final NoJexlClass njc = nojexl.get(classKey(clazz));
return njc != null ? njc : JEXL_CLASS;
}
@@ -439,10 +437,7 @@ public class Permissions implements JexlPermissions {
* @return true if allowed, false otherwise
*/
private boolean allowedPackage(final String packageName) {
- if (allowed.isEmpty() && packages.isEmpty()) {
- return true;
- }
- if (!allowed.isEmpty() && wildcardAllow(allowed, packageName)) {
+ if ((allowed.isEmpty() && packages.isEmpty()) || (!allowed.isEmpty() && wildcardAllow(allowed, packageName))) {
return true;
}
// a package explicitly declared positive allows itself (exact match only, no sub-package inference)
@@ -461,7 +456,7 @@ public class Permissions implements JexlPermissions {
* @param check the condition to test whether the specified name is allowed (not null)
* @return true if the specified name is allowed based on the condition, false otherwise
*/
- private <T> boolean specifiedAllow(final Class<?> clazz, T name, BiPredicate<NoJexlClass, T> check) {
+ private <T> boolean specifiedAllow(final Class<?> clazz, final T name, final BiPredicate<NoJexlClass, T> check) {
final String packageName = ClassTool.getPackageName(clazz);
if (allowedPackage(packageName)) {
return true;
@@ -565,11 +560,8 @@ public class Permissions implements JexlPermissions {
@Override
public boolean allow(final Constructor<?> ctor) {
// method must be not null, public
- if (!validate(ctor)) {
- return false;
- }
// check declared restrictions
- if (deny(ctor)) {
+ if (!validate(ctor) || deny(ctor)) {
return false;
}
// class must agree
@@ -591,11 +583,8 @@ public class Permissions implements JexlPermissions {
@Override
public boolean allow(final Field field) {
// field must be public
- if (!validate(field)) {
- return false;
- }
// check declared restrictions
- if (deny(field)) {
+ if (!validate(field) || deny(field)) {
return false;
}
// class must agree
@@ -613,13 +602,10 @@ public class Permissions implements JexlPermissions {
return false;
}
if ((method.getModifiers() & Modifier.STATIC) == 0) {
- Class<?> declaring = method.getDeclaringClass();
+ final Class<?> declaring = method.getDeclaringClass();
if (clazz != declaring) {
- if (deny(clazz)) {
- return false;
- }
// just check this is an override of a method in clazz, if not, it is not allowed (obviously)
- if (!declaring.isAssignableFrom(clazz)) {
+ if (deny(clazz) || !declaring.isAssignableFrom(clazz)) {
return false;
}
// an explicit permission on the concrete class can deny; otherwise fall through to
@@ -639,13 +625,10 @@ public class Permissions implements JexlPermissions {
return false;
}
if ((field.getModifiers() & Modifier.STATIC) == 0) {
- Class<?> declaring = field.getDeclaringClass();
+ final Class<?> declaring = field.getDeclaringClass();
if (clazz != declaring) {
- if (deny(clazz)) {
- return false;
- }
// just check this clazz extends/inherits from declaring, if not, it is not allowed (obviously)
- if (!declaring.isAssignableFrom(clazz)) {
+ if (deny(clazz) || !declaring.isAssignableFrom(clazz)) {
return false;
}
// an explicit permission on the concrete class can deny; otherwise fall through to
@@ -670,11 +653,8 @@ public class Permissions implements JexlPermissions {
@Override
public boolean allow(final Method method) {
// method must be not null, public, not synthetic, not bridge
- if (!validate(method)) {
- return false;
- }
// method must be allowed
- if (denyMethod(method)) {
+ if (!validate(method) || denyMethod(method)) {
return false;
}
Class<?> clazz = method.getDeclaringClass();
@@ -706,11 +686,8 @@ public class Permissions implements JexlPermissions {
@Override
public boolean allow(final Package pack) {
// field must be public
- if (!validate(pack)) {
- return false;
- }
// check declared restrictions
- if (deny(pack)) {
+ if (!validate(pack) || deny(pack)) {
return false;
}
// an explicit package entry is allowed unless it is the deny marker
@@ -822,7 +799,7 @@ public class Permissions implements JexlPermissions {
private NoJexlClass getNoJexl(final Class<?> clazz) {
return getNoJexl(clazz, JEXL_CLASS);
}
- private NoJexlClass getNoJexl(final Class<?> clazz, NoJexlClass ifNone) {
+ private NoJexlClass getNoJexl(final Class<?> clazz, final NoJexlClass ifNone) {
final String pkgName = ClassTool.getPackageName(clazz);
final NoJexlPackage njp = getNoJexlPackage(pkgName);
if (njp != null) {