You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "Milchreis (via GitHub)" <gi...@apache.org> on 2023/09/28 07:52:21 UTC
[GitHub] [commons-scxml] Milchreis opened a new pull request, #154: [feature] set up allowed class-permissions to JEXL constructor
Milchreis opened a new pull request, #154:
URL: https://github.com/apache/commons-scxml/pull/154
hi,
I had some trouble by using commons-scxml, because JEXL doesn't know my objects. Unfortunately JEXL is not very verbose and I took some time to understand that there are permissions. `commons-scxml` has no "easy" way to add some custom permissions and it needs a deeper understanding to see that the JexlEvaluator has to derive with an overridden `createJexlEngine`-method.
This PR contains a new constructor for JexlEvaluator which allows a custom set of classes which is used in `createJexlEngine()`. Moreover there is a test now, which supportes the usage of classes outside the allowed java- and sxcml2-packages.
I hope it finds a way into this great library 😊
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [feature] set up allowed class-permissions to JEXL constructor [commons-scxml]
Posted by "Milchreis (via GitHub)" <gi...@apache.org>.
Milchreis commented on code in PR #154:
URL: https://github.com/apache/commons-scxml/pull/154#discussion_r1349570285
##########
src/main/java/org/apache/commons/scxml2/env/jexl/JexlEvaluator.java:
##########
@@ -185,7 +195,13 @@ protected JexlEngine createJexlEngine() {
// See javadoc of org.apache.commons.jexl2.JexlEngine#setFunctions(Map<String,Object> funcs) for detail.
final Map<String, Object> funcs = new HashMap<>();
funcs.put(null, JexlBuiltin.class);
+
JexlPermissions permissions = JexlPermissions.RESTRICTED.compose("org.apache.commons.scxml2.*");
+
+ if(customAllowedClasses != null && customAllowedClasses.length > 0) {
Review Comment:
Is done. Variable is rename to `customJexlPermissions` now ([see](https://github.com/apache/commons-scxml/pull/154/files#diff-e9aaca46c5c2de0f4a9fde75d3e1bbd108c244261ab9019693dda200ea4b0846R201]))
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [commons-scxml] garydgregory commented on a diff in pull request #154: [feature] set up allowed class-permissions to JEXL constructor
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on code in PR #154:
URL: https://github.com/apache/commons-scxml/pull/154#discussion_r1339999687
##########
src/main/java/org/apache/commons/scxml2/env/jexl/JexlEvaluator.java:
##########
@@ -185,7 +195,13 @@ protected JexlEngine createJexlEngine() {
// See javadoc of org.apache.commons.jexl2.JexlEngine#setFunctions(Map<String,Object> funcs) for detail.
final Map<String, Object> funcs = new HashMap<>();
funcs.put(null, JexlBuiltin.class);
+
JexlPermissions permissions = JexlPermissions.RESTRICTED.compose("org.apache.commons.scxml2.*");
+
+ if(customAllowedClasses != null && customAllowedClasses.length > 0) {
Review Comment:
Fix formatting.
##########
src/main/java/org/apache/commons/scxml2/env/jexl/JexlEvaluator.java:
##########
@@ -74,11 +74,21 @@ public Evaluator getEvaluator(final SCXML document) {
/** The internal JexlEngine instance to use. */
private transient volatile JexlEngine jexlEngine;
+ /** Optional: saves user defined packages, which JEXL should allow for evaluation */
+ private String[] customAllowedClasses;
+
/** Constructor. */
public JexlEvaluator() {
jexlEngine = getJexlEngine();
}
+ /** Constructor with further allowed classes or packages. Use an asterix for all classes in a package */
+ public JexlEvaluator(String... customAllowedClasses) {
Review Comment:
I think we should use the builder pattern instead of adding public constructors.
##########
src/test/java/com/custom/Payload.java:
##########
@@ -0,0 +1,20 @@
+package com.custom;
Review Comment:
Missing Apache License header.
##########
src/main/java/org/apache/commons/scxml2/env/jexl/JexlEvaluator.java:
##########
@@ -185,7 +195,13 @@ protected JexlEngine createJexlEngine() {
// See javadoc of org.apache.commons.jexl2.JexlEngine#setFunctions(Map<String,Object> funcs) for detail.
final Map<String, Object> funcs = new HashMap<>();
funcs.put(null, JexlBuiltin.class);
+
JexlPermissions permissions = JexlPermissions.RESTRICTED.compose("org.apache.commons.scxml2.*");
+
+ if(customAllowedClasses != null && customAllowedClasses.length > 0) {
Review Comment:
Formatting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [feature] set up allowed class-permissions to JEXL constructor [commons-scxml]
Posted by "Milchreis (via GitHub)" <gi...@apache.org>.
Milchreis commented on code in PR #154:
URL: https://github.com/apache/commons-scxml/pull/154#discussion_r1349570424
##########
src/main/java/org/apache/commons/scxml2/env/jexl/JexlEvaluator.java:
##########
@@ -74,11 +74,21 @@ public Evaluator getEvaluator(final SCXML document) {
/** The internal JexlEngine instance to use. */
private transient volatile JexlEngine jexlEngine;
+ /** Optional: saves user defined packages, which JEXL should allow for evaluation */
+ private String[] customAllowedClasses;
+
/** Constructor. */
public JexlEvaluator() {
jexlEngine = getJexlEngine();
}
+ /** Constructor with further allowed classes or packages. Use an asterix for all classes in a package */
+ public JexlEvaluator(String... customAllowedClasses) {
Review Comment:
Did some work and added a builder-class which now provides the different options. Moreover it is used in 2 test cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org