jsinovassin opened a new pull request, #892: URL: https://github.com/apache/unomi/pull/892
## Summary - Backport of #877 to `unomi-3.0.x`, re-cut from the current branch head. - `org.mvel2.*` leaves the shipped scripting allow-list. No MVEL class can be named by an expression any more, and MVEL's own internals keep loading from the MVEL bundle class loader, so accepted expressions still compile. - The public MVEL eval APIs are denied in code from the scripting class loader, including the inner-class, array, slash and zero-width name forms, so emptying the forbid list or setting the allow list to `all` does not re-arm them. - The forbid pattern for `eval` is matched after invisible characters are stripped. Request sanitizing is no longer treated as the control that has to enumerate every prefix encoding. - The filter now runs on every execution rather than on first compile only, so a script cached while the policy was looser is rejected once the policy is tightened. Only accepted expressions are cached. ## Differences from master - `THREAT_MODEL.md` does not come across. The document does not exist on this line, and a maintenance branch is not where it should first appear. - Everything else applies unchanged, including the four test classes. ## What a deployment has to know The allow list shipped in `custom.system.properties` no longer contains `org.mvel2.*`. An operator who set `UNOMI_ALLOW_SCRIPTING_CLASSES` by hand keeps their own value, and a value that still names an MVEL class keeps naming it. The release notes of this line should carry that. ## Test plan - [ ] `SecureFilteringClassLoaderTest`, `ExpressionFilterTest`, `ExpressionFilterFactoryImplTest` and `MvelScriptExecutorTest` on this branch, CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
