Class JexlSandbox
A allowlist explicitly allows methods/properties for a class;
- If a allowlist is empty and thus does not contain any names, all properties/methods are allowed for its class.
- If it is not empty, the only allowed properties/methods are the ones contained.
A blocklist explicitly forbids methods/properties for a class;
- If a blocklist is empty and thus does not contain any names, all properties/methods are forbidden for its class.
- If it is not empty, the only forbidden properties/methods are the ones contained.
Permissions are composed of three lists, read, write, execute, each being "allow" or "block":
- read controls readable properties
- write controls writable properties
- execute controls executable methods and constructor
When specified, permissions - allow or block lists - can be created inheritable on interfaces or classes and thus applicable to their implementations or derived classes; the sandbox must be created with the 'inheritable' flag for this behavior to be triggered. Note that even in this configuration, it is still possible to add non-inheritable permissions. Adding inheritable lists to a non inheritable sandbox has no added effect; permissions only apply to their specified class.
Note that a JexlUberspect always uses a copy of the JexlSandbox used to built it preventing permission changes after its instantiation.
- Since:
- 3.0
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescription(package private) static class
A allow set of names.static final class
Deprecated.(package private) static class
A block set of names.static class
A base set of names.static final class
Contains the allow or block lists for properties and methods for a given class.static final class
Deprecated.since 3.2, useJexlSandbox.AllowSet
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final boolean
Default behavior, block or allow.private static final JexlSandbox.Permissions
The pass-thru permissions.private static final JexlSandbox.Names
The pass-thru name set.private static final JexlSandbox.Permissions
The block-all permissions.private static final JexlSandbox.Names
The block-all name set.private final boolean
Whether permissions can be inherited (through implementation or extension).static final String
The marker string for explicitly disallowed null properties.private final Map<String,
JexlSandbox.Permissions> The map from class names to permissions. -
Constructor Summary
ConstructorsModifierConstructorDescriptionCreates a new default sandbox.JexlSandbox
(boolean ab) Creates a new default sandbox.JexlSandbox
(boolean ab, boolean inh) Creates a sandbox.protected
JexlSandbox
(boolean ab, boolean inh, Map<String, JexlSandbox.Permissions> map) Creates a sandbox based on an existing permissions map.protected
JexlSandbox
(boolean ab, Map<String, JexlSandbox.Permissions> map) Deprecated.protected
Deprecated. -
Method Summary
Modifier and TypeMethodDescriptionCreates a new set of permissions based on allow lists for methods and properties for a given class.Deprecated.Creates a new set of permissions based on block lists for methods and properties for a given class.copy()
Gets the execute permission value for a given method of a class.Deprecated.(package private) static Class<?>
Gets a class by name, crude mechanism for backwards (<3.2 ) compatibility.Get the permissions associated to a class.Gets the set of permissions associated to a class.permissions
(String clazz, boolean readFlag, boolean writeFlag, boolean executeFlag) Creates the set of permissions for a given class.permissions
(String clazz, boolean inhf, boolean readf, boolean writef, boolean execf) Creates the set of permissions for a given class.Gets the read permission value for a given property of a class.Deprecated.Deprecated.Gets the write permission value for a given property of a class.Deprecated.
-
Field Details
-
NULL
The marker string for explicitly disallowed null properties.- See Also:
-
sandbox
The map from class names to permissions. -
inherit
private final boolean inheritWhether permissions can be inherited (through implementation or extension). -
allow
private final boolean allowDefault behavior, block or allow. -
ALLOW_NAMES
The pass-thru name set. -
BLOCK_NAMES
The block-all name set. -
ALLOW_ALL
The pass-thru permissions. -
BLOCK_ALL
The block-all permissions.
-
-
Constructor Details
-
JexlSandbox
public JexlSandbox()Creates a new default sandbox.In the absence of explicit permissions on a class, the sandbox is a allow-box, allow-listing that class for all permissions (read, write and execute).
-
JexlSandbox
public JexlSandbox(boolean ab) Creates a new default sandbox.A allow-box considers no permissions as "everything is allowed" when a block-box considers no permissions as "nothing is allowed".
- Parameters:
ab
- whether this sandbox is allow (true) or block (false) if no permission is explicitly defined for a class.- Since:
- 3.1
-
JexlSandbox
public JexlSandbox(boolean ab, boolean inh) Creates a sandbox.- Parameters:
ab
- whether this sandbox is allow (true) or block (false)inh
- whether permissions on interfaces and classes are inherited (true) or not (false)- Since:
- 3.2
-
JexlSandbox
Deprecated.Creates a sandbox based on an existing permissions map.- Parameters:
map
- the permissions map
-
JexlSandbox
Deprecated.Creates a sandbox based on an existing permissions map.- Parameters:
ab
- whether this sandbox is allow (true) or block (false)map
- the permissions map- Since:
- 3.1
-
JexlSandbox
Creates a sandbox based on an existing permissions map.- Parameters:
ab
- whether this sandbox is allow (true) or block (false)inh
- whether permissions are inherited, default falsemap
- the permissions map- Since:
- 3.2
-
-
Method Details
-
copy
- Returns:
- a copy of this sandbox
-
forName
Gets a class by name, crude mechanism for backwards (<3.2 ) compatibility.- Parameters:
cname
- the class name- Returns:
- the class
-
read
Gets the read permission value for a given property of a class.- Parameters:
clazz
- the classname
- the property name- Returns:
- null (or NULL if name is null) if not allowed, the name of the property to use otherwise
-
read
Deprecated.Gets the read permission value for a given property of a class.- Parameters:
clazz
- the class namename
- the property name- Returns:
- null if not allowed, the name of the property to use otherwise
-
write
Gets the write permission value for a given property of a class.- Parameters:
clazz
- the classname
- the property name- Returns:
- null (or NULL if name is null) if not allowed, the name of the property to use otherwise
-
write
Deprecated.Gets the write permission value for a given property of a class.- Parameters:
clazz
- the class namename
- the property name- Returns:
- null if not allowed, the name of the property to use otherwise
-
execute
Gets the execute permission value for a given method of a class.- Parameters:
clazz
- the classname
- the method name- Returns:
- null if not allowed, the name of the method to use otherwise
-
execute
Deprecated.Gets the execute permission value for a given method of a class.- Parameters:
clazz
- the class namename
- the method name- Returns:
- null if not allowed, the name of the method to use otherwise
-
permissions
public JexlSandbox.Permissions permissions(String clazz, boolean readFlag, boolean writeFlag, boolean executeFlag) Creates the set of permissions for a given class.The sandbox inheritance property will apply to the permissions created by this method
- Parameters:
clazz
- the class for which these permissions applyreadFlag
- whether the readable property list is allow - true - or block - false -writeFlag
- whether the writable property list is allow - true - or block - false -executeFlag
- whether the executable method list is allow - true - or block - false -- Returns:
- the set of permissions
-
permissions
public JexlSandbox.Permissions permissions(String clazz, boolean inhf, boolean readf, boolean writef, boolean execf) Creates the set of permissions for a given class.- Parameters:
clazz
- the class for which these permissions applyinhf
- whether these permissions are inheritablereadf
- whether the readable property list is allow - true - or block - false -writef
- whether the writable property list is allow - true - or block - false -execf
- whether the executable method list is allow - true - or block - false -- Returns:
- the set of permissions
-
allow
Creates a new set of permissions based on allow lists for methods and properties for a given class.The sandbox inheritance property will apply to the permissions created by this method
- Parameters:
clazz
- the allowed class name- Returns:
- the permissions instance
-
white
Deprecated.Use allow() instead.- Parameters:
clazz
- the allowed class name- Returns:
- the permissions instance
-
block
Creates a new set of permissions based on block lists for methods and properties for a given class.The sandbox inheritance property will apply to the permissions created by this method
- Parameters:
clazz
- the blocked class name- Returns:
- the permissions instance
-
black
Deprecated.Use block() instead.- Parameters:
clazz
- the allowed class name- Returns:
- the permissions instance
-
get
Gets the set of permissions associated to a class.- Parameters:
clazz
- the class name- Returns:
- the defined permissions or an all-allow permission instance if none were defined
-
get
Get the permissions associated to a class.- Parameters:
clazz
- the class- Returns:
- the permissions
-
JexlSandbox.BlockSet