ThisaraWeerakoon commented on code in PR #124:
URL: https://github.com/apache/synapse/pull/124#discussion_r4535312901
##########
modules/core/src/main/java/org/apache/synapse/mediators/Value.java:
##########
@@ -195,23 +218,90 @@ public boolean hasPropertyEvaluateExpr(){
public Object evalutePropertyExpression(MessageContext synCtx) {
SynapseXPath expr = null;
+ SynapseXPath expression;
try {
expr = new SynapseXPath(this.keyValue.substring(1,
keyValue.length() - 1));
for (OMNamespace aNamespaceList : namespaceList) {
expr.addNamespace(aNamespaceList);
}
String result = expr.stringValueOf(synCtx);
- SynapseXPath expression = new SynapseXPath(result);
+ expression = new SynapseXPath(result);
for (OMNamespace aNamespaceList : namespaceList) {
expression.addNamespace(aNamespaceList);
}
- return expression;
} catch (Exception e) {
handleException("Can not evaluate escaped expression : " + expr);
+ return this.expression;
}
- return this.expression;
+ String restrictedFunction =
findRestrictedFunction(expression.getRootExpr());
+ if (restrictedFunction != null) {
+ handleException("The function '" + restrictedFunction + "' is not
allowed in a "
+ + "dynamically evaluated template parameter expression");
+ }
+ return expression;
+ }
+
+ /**
+ * Walks a parsed XPath expression tree and returns the name of the first
function call
+ * that is in {@link #RESTRICTED_DYNAMIC_FUNCTIONS}, or {@code null} if
there is none. The
+ * whole tree is inspected, including function arguments and step
predicates.
+ *
+ * @param node a node of the parsed expression tree (an {@link Expr},
{@link Step} or
+ * {@link Predicate}); may be {@code null}
+ * @return the restricted function name if one is present, otherwise
{@code null}
+ */
+ private String findRestrictedFunction(Object node) {
+ if (node == null) {
+ return null;
+ }
+ if (node instanceof FunctionCallExpr) {
Review Comment:
Agreed. Addressed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
