org.broadleafcommerce.test.common.rule

Class MvelExpressionValidatorTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.broadleafcommerce.test.common.rule.MvelExpressionValidatorTest

All Implemented Interfaces:

junit.framework.Test

public class MvelExpressionValidatorTest
extends junit.framework.TestCase

Constructor Summary

Constructors

Constructor and Description
MvelExpressionValidatorTest()

Method Summary

Modifier and Type	Method and Description
void	testBlockedMethodsAreRejected()
void	testBlockedMethodsWithoutParenthesesAreRejected() MVEL calls no argument methods written as properties, so blocked methods must be blocked in that form too.
void	testBuiltInMethodsCanBeAllowedWithProperty() Allowing a built-in blocked method allows only that method, e.g.
void	testCodeHiddenFromTheValidatorIsRejected() The validator must agree with MVEL on where string literals and comments start and end.
void	testCodeInsideStringLiteralsIsAllowed()
void	testConstructorsAreRejected()
void	testExpressionCompilationAndExecutionIsRejected() MVEL can compile and evaluate any expression, so the compile and execute methods are blocked, whether reached through the fully qualified org.mvel2.MVEL or the bare MVEL import, and whichever of them is used.
void	testJvmTerminationIsRejected() System.exit kills the JVM, so it is blocked, like the already blocked halt.
void	testLongStringLiteralsAreAllowed() Long string values, with or without escapes, must not overflow the stack while being removed.
void	testMethodsCanBeBlockedWithProperty()
void	testNewInsideValuesAndNamesIsAllowed() Product, sku and other names containing "new" are values in string literals, or part of a longer name, and must not be mistaken for the new keyword.
void	testNullAndEmptyExpressionsAreAllowed() String literal contents are data and must never be treated as code.
void	testObjectCreationWithoutNewIsRejected() Factory methods that create or load classes without using new
void	testReflectionIsRejected()
void	testReportedPayloadIsRejected()
void	testRuleBuilderExpressionsAreAllowed() Expressions generated by the rule builder, including legacy forms, and hand written rules from the tests and demo data must remain allowed.
void	testShippedDemoAndTestRulesAreAllowed() Rules harvested from the 6.0 reference-site demo/seed SQL and the offer test data providers must keep validating, so enabling the validator never silently breaks an existing stored rule (the false-positive regression guard).
void	testStatementSeparatorsAreRejected()
void	testValidationCanBeTurnedOffWithProperty()
void	testValidationIsEnabledByDefault()

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

MvelExpressionValidatorTest

public MvelExpressionValidatorTest()

Method Detail

testRuleBuilderExpressionsAreAllowed

public void testRuleBuilderExpressionsAreAllowed()

Expressions generated by the rule builder, including legacy forms, and hand written rules from the tests and demo data must remain allowed.

testShippedDemoAndTestRulesAreAllowed

public void testShippedDemoAndTestRulesAreAllowed()

Rules harvested from the 6.0 reference-site demo/seed SQL and the offer test data providers must keep validating, so enabling the validator never silently breaks an existing stored rule (the false-positive regression guard).

testNullAndEmptyExpressionsAreAllowed

public void testNullAndEmptyExpressionsAreAllowed()

String literal contents are data and must never be treated as code.

testCodeInsideStringLiteralsIsAllowed

public void testCodeInsideStringLiteralsIsAllowed()

testNewInsideValuesAndNamesIsAllowed

public void testNewInsideValuesAndNamesIsAllowed()

Product, sku and other names containing "new" are values in string literals, or part of a longer name, and must not be mistaken for the new keyword.

testReportedPayloadIsRejected

public void testReportedPayloadIsRejected()

testExpressionCompilationAndExecutionIsRejected

public void testExpressionCompilationAndExecutionIsRejected()

MVEL can compile and evaluate any expression, so the compile and execute methods are blocked, whether reached through the fully qualified org.mvel2.MVEL or the bare MVEL import, and whichever of them is used.

testJvmTerminationIsRejected

public void testJvmTerminationIsRejected()

System.exit kills the JVM, so it is blocked, like the already blocked halt.

testConstructorsAreRejected

public void testConstructorsAreRejected()

testObjectCreationWithoutNewIsRejected

public void testObjectCreationWithoutNewIsRejected()

Factory methods that create or load classes without using new

testReflectionIsRejected

public void testReflectionIsRejected()

testBlockedMethodsAreRejected

public void testBlockedMethodsAreRejected()

testStatementSeparatorsAreRejected

public void testStatementSeparatorsAreRejected()

testBlockedMethodsWithoutParenthesesAreRejected

public void testBlockedMethodsWithoutParenthesesAreRejected()

MVEL calls no argument methods written as properties, so blocked methods must be blocked in that form too.

testCodeHiddenFromTheValidatorIsRejected

public void testCodeHiddenFromTheValidatorIsRejected()

The validator must agree with MVEL on where string literals and comments start and end.

testLongStringLiteralsAreAllowed

public void testLongStringLiteralsAreAllowed()

Long string values, with or without escapes, must not overflow the stack while being removed.

testValidationIsEnabledByDefault

public void testValidationIsEnabledByDefault()

testValidationCanBeTurnedOffWithProperty

public void testValidationCanBeTurnedOffWithProperty()

testMethodsCanBeBlockedWithProperty

public void testMethodsCanBeBlockedWithProperty()

testBuiltInMethodsCanBeAllowedWithProperty

public void testBuiltInMethodsCanBeAllowedWithProperty()

Allowing a built-in blocked method allows only that method, e.g. for a custom field called load