How to disable JEXL assignments?

Question

I have an application that allows users to enter JEXL expressions. They are used as search filters. A common mistake users do is to write something like "A=5" and expect the filter to be true if and only if the variable A contains the value 5.

Yes, you are right: the = operator is the assignment, and users should have used == for comparison. A workaround like rejecting expressions that match the regular expression [^=]=[^=] would also not allow to compare strings like A=="foo=bar" so it is not the solution.

Is there a chance to remove the assignment operator from a JexlEngine via runtime configuration so it would throw an Exception during parse? Or alternatively find out that the JexlExpression contains an assignment?

It seems some internal syntax tree exists. How to access it? https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/JexlExpression.html#getParsedText-- — Queeg, Jan 25 '21 at 11:02

score 2 · Answer 1 · answered Feb 03 '21 at 06:24

2

If you can use JEXL 3.2 trunk (ie build it from the source) , there is a way through 'features' to achieve this by disabling side-effect and global side-effects.

JexlFeatures features = new JexlFeatures().sideEffect(false).sideEffectGlobal(false);
...
JexlInfo info = ...
JexlScript script = jexl.createScript(features, info, source);
...

The createScript will throw a JexlException.Feature indicating that syntactic feature was disabled.

answered Feb 03 '21 at 06:24

henrib

187
6

I will try that out once it is stable. But thank you for mentioning. – Queeg Feb 04 '21 at 09:45

score 1 · Accepted Answer · answered Jan 25 '21 at 11:56

So it looks like the JEXL API does not offer any access to the syntax tree or to define the allowed operators. What helped me so far was to modify my implementation of the JexlContext.

By overriding the set method to throw an Exception at least I get an error during runtime. I'd still prefer to have an error at parse-time of the expression, but it saves the day.

How to disable JEXL assignments?

2 Answers2