Henri Biestro created JEXL-469:
----------------------------------
Summary: Add JexlFeatures to control namespace functor
auto-instantiation
Key: JEXL-469
URL: https://issues.apache.org/jira/browse/JEXL-469
Project: Commons JEXL
Issue Type: Improvement
Affects Versions: 3.7.0
Reporter: Henri Biestro
Assignee: Henri Biestro
Fix For: 3.7.1
When a namespace is declared as a Class or a fully-qualified class name string,
JEXL automatically instantiates it into a functor via reflection the first time
it is used. This behaviour has no opt-out.
This improvement adds JexlFeatures.namespaceInstantiation(boolean) to control
that behaviour. When disabled, only static methods of the bound class are
reachable and no constructor is invoked. The default is true, preserving
backward compatibility.
As a related hardening, a string namespace resolved to a class now goes through
the permission-aware JexlUberspect.getClassByName rather than loading the class
directly, so permission rules apply consistently to class-name namespace
bindings.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
