org.broadleafcommerce.common.rule

Class MvelExpressionValidator

java.lang.Object

org.broadleafcommerce.common.rule.MvelExpressionValidator

@Component(value="blMvelExpressionValidator")
public class MvelExpressionValidator
extends Object

Validates MVEL rule expressions before they are saved and before MvelHelper compiles them. MVEL has no sandbox of its own, so an expression is rejected if it uses new, a reflection method (BLOCKED_REFLECTION_METHODS), a method that can run commands or change the server or its data (BLOCKED_METHODS), or a statement separator (;). Methods are blocked whether they are called with parentheses or accessed like a property, since MVEL calls no argument methods for both.

MVEL.eval can evaluate any expression, so only the legacy MVEL.eval("toUpperCase()", value) form generated by older versions of the rule builder is allowed.

String literals are removed before the check, read the same way MVEL reads them, so their contents are never mistaken for code.

The validation can be turned off with the mvel.expression.validation.enabled property. Methods can be blocked in addition to the built-in ones with the mvel.expression.validation.blocked.methods property, and built-in ones can be allowed with the mvel.expression.validation.allowed.methods property, e.g. for custom fields with the same name as a blocked method. This class is a bean only so that the properties can be injected.

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	MvelExpressionValidator()

Method Summary

Modifier and Type	Method and Description
static boolean	isAllowed(String expression) Checks the expression and logs a warning if it is not allowed.
void	setAllowedMethods(String allowedMethods)
void	setBlockedMethods(String blockedMethods)
void	setEnabled(boolean enabled)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MvelExpressionValidator

protected MvelExpressionValidator()

Method Detail

setEnabled

@Value(value="${mvel.expression.validation.enabled:true}")
public void setEnabled(boolean enabled)

setBlockedMethods

@Value(value="${mvel.expression.validation.blocked.methods:}")
public void setBlockedMethods(String blockedMethods)

Parameters:

blockedMethods - comma separated method names to block in addition to the built-in ones

setAllowedMethods

@Value(value="${mvel.expression.validation.allowed.methods:}")
public void setAllowedMethods(String allowedMethods)

Parameters:

allowedMethods - comma separated built-in blocked method names to allow, e.g. for custom fields that have the same name as a blocked method

isAllowed

public static boolean isAllowed(String expression)

Checks the expression and logs a warning if it is not allowed. A null expression is allowed, the same as an empty one, since there is no rule.

Parameters:

expression - the MVEL expression exactly as it will be compiled

Returns:

true if the expression may be compiled and executed