Henri Biestro created JEXL-468:
----------------------------------
Summary: Improve robustness of introspection permissions and
sandbox delegation
Key: JEXL-468
URL: https://issues.apache.org/jira/browse/JEXL-468
Project: Commons JEXL
Issue Type: Bug
Affects Versions: 3.7.0
Reporter: Henri Biestro
Assignee: Henri Biestro
Fix For: 3.7.1
Several gaps in the permissions and sandbox layer have been identified:
- Introspection permission rules are not consistently applied to nested classes
and interface-declared members.
- A class-initialization ordering issue can cause permission markers to be
unresolved at startup.
- The sandbox uberspect does not gate iteration; iteration needs to respect the
configured permissions.
- The permission DSL parser mishandles mixed +/- polarity, causing rules to
leak across class blocks.
- The JEXL engine's compiler surface (createScript, createExpression,
createJxltEngine) needs to be denied under RESTRICTED permissions, preventing a
script from compiling further scripts via a live engine reference.
- Parser feature enforcement are not applied to sub-parsers (JXLT embedded
fragments), causing them to run under stale feature state.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
