[
https://issues.apache.org/jira/browse/JEXL-468?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Henri Biestro resolved JEXL-468.
--------------------------------
Resolution: Fixed
Commit
[4696226|https://github.com/apache/commons-jexl/commit/46962260500266df56e120cf3cd746d3ee237522]
&
[8df1451|https://github.com/apache/commons-jexl/commit/8df14514af2dbc79df8fca049ffc6e9551576cae]
> Improve robustness of introspection permissions and sandbox delegation
> ----------------------------------------------------------------------
>
> Key: JEXL-468
> URL: https://issues.apache.org/jira/browse/JEXL-468
> Project: Commons JEXL
> Issue Type: Bug
> Affects Versions: 3.7.0
> Reporter: Henri Biestro
> Assignee: Henri Biestro
> Priority: Major
> Fix For: 3.7.1
>
>
> Several gaps in the permissions and sandbox layer have been identified:
> - Introspection permission rules are not consistently applied to nested
> classes and interface-declared members.
> - A class-initialization ordering issue can cause permission markers to be
> unresolved at startup.
> - The sandbox uberspect does not gate iteration; iteration needs to respect
> the configured permissions.
> - The permission DSL parser mishandles mixed +/- polarity, causing rules to
> leak across class blocks.
> - The JEXL engine's compiler surface (createScript, createExpression,
> createJxltEngine) needs to be denied under RESTRICTED permissions, preventing
> a script from compiling further scripts via a live engine reference.
> - Parser feature enforcement are not applied to sub-parsers (JXLT embedded
> fragments), causing them to run under stale feature state.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
