[jira] [Commented] (OOZIE-2557) Introduce possibility to invoke Java static method

["Robert Kanter (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OOZIE-2557?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15334726#comment-15334726 ] 

Robert Kanter commented on OOZIE-2557:
--------------------------------------

If we do this, we should probably have a black and/or white list.  Allowing arbitrary code execution on the Oozie Server is dangerous, especially because they get executed as the Oozie user.  We should be very careful with the default black/white list.

> Introduce possibility to invoke Java static method
> --------------------------------------------------
>
>                 Key: OOZIE-2557
>                 URL: https://issues.apache.org/jira/browse/OOZIE-2557
>             Project: Oozie
>          Issue Type: Improvement
>          Components: bundle, coordinator, workflow
>    Affects Versions: 4.2.0
>            Reporter: Nazar Volynets
>
> Please introduce possibility to call any Java static method in application classpath by reflection.
> h5. Option 1 - New Basic Oozie/EL Function
> These function should provide a possibility to specify input arguments for target  Java static method.
> Example:
> * function signature
> {code}
> Type —> String, int, boolean, double
> Type callStaticMethod(String clazz, String method, [Type arg1, [Type argN])
> {code}
> * function usage
> {code}
> ${ callStaticMethod('java.lang.Integer', 'valueOf', '10') }
> {code}
> h5. Option 2 - Introduce scriptlets like in JSP
> Use special character % for it. It should be possible to mix it with Oozie/EL.
> Example:
> {code}
> %{ java.lang.Integer.valueOf('10') }
> %{ java.lang.Integer.valueOf(${someStringValue}) }
> {code}
> {quote}
> It will bring a lot of benefits due the list of available EL functions isn't very wide.
> {quote}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)