Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(fix): check innerClazz while get property #571

Merged
merged 1 commit into from
Oct 3, 2023
Merged

(fix): check innerClazz while get property #571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions src/main/java/com/googlecode/aviator/AviatorEvaluatorInstance.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
import com.googlecode.aviator.code.interpreter.InterpretCodeGenerator;
import com.googlecode.aviator.exception.CompileExpressionErrorException;
import com.googlecode.aviator.exception.ExpressionNotFoundException;
import com.googlecode.aviator.exception.ExpressionRuntimeException;
import com.googlecode.aviator.exception.ExpressionSyntaxErrorException;
import com.googlecode.aviator.exception.UnsupportedFeatureException;
import com.googlecode.aviator.lexer.ExpressionLexer;
Expand Down Expand Up @@ -1885,4 +1886,37 @@ public StringSegments compileStringSegments(final String lexeme, final String so
return new StringSegments(Collections.<StringSegment>emptyList(), 0);
}
}


/**
* check if class is in Options.ALLOWED_CLASS_SET
*
* @param checkIfAllow check or not
* @param clazz the class for check
* @return the class for check
*/
public Class<?> checkIfClassIsAllowed(final boolean checkIfAllow, final Class<?> clazz) {
if (checkIfAllow) {
Set<Class<?>> allowedList = this.getOptionValue(Options.ALLOWED_CLASS_SET).classes;
if (allowedList != null) {
// Null list means allowing all classes
if (!allowedList.contains(clazz)) {
throw new ExpressionRuntimeException(
"`" + clazz + "` is not in allowed class set, check Options.ALLOWED_CLASS_SET");
}
}
Set<Class<?>> assignableList =
this.getOptionValue(Options.ASSIGNABLE_ALLOWED_CLASS_SET).classes;
if (assignableList != null) {
for (Class<?> aClass : assignableList) {
if (aClass.isAssignableFrom(clazz)) {
return clazz;
}
}
throw new ExpressionRuntimeException(
"`" + clazz + "` is not in allowed class set, check Options.ALLOWED_CLASS_SET");
}
}
return clazz;
}
}
29 changes: 1 addition & 28 deletions src/main/java/com/googlecode/aviator/utils/Env.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,6 @@
import com.googlecode.aviator.AviatorEvaluatorInstance;
import com.googlecode.aviator.Expression;
import com.googlecode.aviator.Feature;
import com.googlecode.aviator.Options;
import com.googlecode.aviator.exception.ExpressionRuntimeException;
import com.googlecode.aviator.runtime.function.FunctionUtils;
import com.googlecode.aviator.runtime.type.Range;

Expand Down Expand Up @@ -199,32 +197,7 @@ public Class<?> resolveClassSymbol(final String name, final boolean checkIfAllow
throw new ClassNotFoundException(name);
}
put2cache(name, clazz);
return checkIfClassIsAllowed(checkIfAllow, clazz);
}

private Class<?> checkIfClassIsAllowed(final boolean checkIfAllow, final Class<?> clazz) {
if (checkIfAllow) {
Set<Class<?>> allowedList = this.instance.getOptionValue(Options.ALLOWED_CLASS_SET).classes;
if (allowedList != null) {
// Null list means allowing all classes
if (!allowedList.contains(clazz)) {
throw new ExpressionRuntimeException(
"`" + clazz + "` is not in allowed class set, check Options.ALLOWED_CLASS_SET");
}
}
Set<Class<?>> assignableList =
this.instance.getOptionValue(Options.ASSIGNABLE_ALLOWED_CLASS_SET).classes;
if (assignableList != null) {
for (Class<?> aClass : assignableList) {
if (aClass.isAssignableFrom(clazz)) {
return clazz;
}
}
throw new ExpressionRuntimeException(
"`" + clazz + "` is not in allowed class set, check Options.ALLOWED_CLASS_SET");
}
}
return clazz;
return this.instance.checkIfClassIsAllowed(checkIfAllow, clazz);
}

private Class<?> resolveFromImportedPackages(final String name) {
Expand Down
3 changes: 3 additions & 0 deletions src/main/java/com/googlecode/aviator/utils/Reflector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -797,6 +797,9 @@ public static Object fastGetProperty(final String name, final String[] names,

if (target.innerClazz != null) {
final AviatorEvaluatorInstance instance = RuntimeUtils.getInstance(env);
// check innerClazz is allowed
instance.checkIfClassIsAllowed(true, target.innerClazz);

if (tryResolveStaticMethod && instance.isFeatureEnabled(Feature.StaticMethods)
&& names.length == 2) {
val = fastGetProperty(target.innerClazz, rName, PropertyType.StaticMethod);
Expand Down
Loading