zhouxy108/hutool
1
0
Fork 0
mirror of https://gitee.com/chinabugotech/hutool.git synced 2025-08-18 20:38:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复QLExpressEngineallowClassSet无效问题（issue#3994@Github）

Browse Source
This commit is contained in:
Looly
2025-07-22 15:26:19 +08:00
parent 325f5a5324
commit 3d0d8dea4b
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -12,6 +12,7 @@
* 【extra 】 `Sftp``reconnectIfTimeout`方法改为捕获所有异常（issue#3989@Github） * 【extra 】 `Sftp``reconnectIfTimeout`方法改为捕获所有异常（issue#3989@Github）
* 【core 】 修复`ChineseDate `闰年闰月节日获取问题（issue#ICL1BT@Gitee） * 【core 】 修复`ChineseDate `闰年闰月节日获取问题（issue#ICL1BT@Gitee）
* 【core 】 修复`TreeBuilder`append重复向idTreeMap中put问题（pr#3992@Github） * 【core 】 修复`TreeBuilder`append重复向idTreeMap中put问题（pr#3992@Github）
* 【extra 】 修复`QLExpressEngine`allowClassSet无效问题（issue#3994@Github）
------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------
# 5.8.39(2025-06-20) # 5.8.39(2025-06-20)

17
hutool-extra/src/main/java/cn/hutool/extra/expression/engine/qlexpress/QLExpressEngine.java
View File

@@ -4,7 +4,10 @@ import cn.hutool.extra.expression.ExpressionEngine;
import cn.hutool.extra.expression.ExpressionException; import cn.hutool.extra.expression.ExpressionException;
import com.ql.util.express.DefaultContext; import com.ql.util.express.DefaultContext;
import com.ql.util.express.ExpressRunner; import com.ql.util.express.ExpressRunner;
import com.ql.util.express.config.QLExpressRunStrategy;
import javax.naming.InitialContext;
import java.lang.reflect.Method;
import java.util.Collection; import java.util.Collection;
import java.util.Map; import java.util.Map;
@@ -24,10 +27,24 @@ public class QLExpressEngine implements ExpressionEngine {
*/ */
public QLExpressEngine() { public QLExpressEngine() {
engine = new ExpressRunner(); engine = new ExpressRunner();
// issue#3994@Github
// Enforce blacklisting of high-risk method invocations
QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
// Explicitly forbid JNDI lookup calls through InitialContext
QLExpressRunStrategy.addSecurityRiskMethod(InitialContext.class, "doLookup");
} }
@Override @Override
public Object eval(final String expression, final Map<String, Object> context, Collection<Class<?>> allowClassSet) { public Object eval(final String expression, final Map<String, Object> context, Collection<Class<?>> allowClassSet) {
// issue#3994@Github
if (null != allowClassSet) {
for (Class<?> clazz : allowClassSet) {
for (Method method : clazz.getDeclaredMethods()) {
QLExpressRunStrategy.addSecureMethod(clazz, method.getName());
}
}
}
final DefaultContext<String, Object> defaultContext = new DefaultContext<>(); final DefaultContext<String, Object> defaultContext = new DefaultContext<>();
defaultContext.putAll(context); defaultContext.putAll(context);
try { try {