You should implement your own context:
public class ZenContext implements JexlContext {
static private final Map<String, Object> reservedVars = new HashMap<String, Object>();
private final Map<String, Object> scriptDefinedVars = new HashMap<String, Object>();
static {
reservedVars.put("math", java.lang.Math.class);
reservedVars.put("stats", apache.commons.math3.stats.Stats);
// whatever else ...
}
public boolean has(String name) {
if (reservedVars .get(name) != null) return true;
return scriptDefinedVars.get(name) != null;
}
public boolean get (String name) {
Object value = null;
if ((value = reservedVars .get(name)) != null) return value;
return scriptDefinedVars.get(name);
}
public void set(String name, Object value) {
scriptDefinedVars.set(name, value);
}
public Map<String, Object> getReservedVars () {
return reservedVars;
}
public Map<String, Object> getScriptDefinedVars () {
return scriptDefinedVars ;
}
}
In this way, you would have
- a map of reserved var names to contain Objects you do not allow scripts to change their values. e.g.,
- a separate map of vars that could be set from script.
And then add these methods.
public Object execute(File scriptFile) {
JexlScript script = jexlEngine.createScript(scriptFile);
return script.execute(this); // supply this as the context
}
public Object execute (String scriptText) {
JexlScript script = jexlEngine.createScript(scriptText);
return script.execute(this); // supply this as the context
}
You could modify the set method I wrote here, to inspect the variables in the maps, before allowing them to set.
However, this will not work for local script vars
var greeting = 'The rain in Maine falls plainly insane';
Because local var relies on a different mechanism, org.apache.commons.jexl3.internal.Scope, using the getLocalVariables() method, which has a bug.