Package org.broadleafcommerce.common.rule

Class MvelExpressionValidator

java.lang.Object
org.broadleafcommerce.common.rule.MvelExpressionValidator
@Component("blMvelExpressionValidator") public class MvelExpressionValidator extends Object
Validates MVEL rule expressions before they are saved and before MvelHelper compiles them. MVEL has no sandbox of its own, so an expression is rejected if it uses new, a reflection method (BLOCKED_REFLECTION_METHODS), a method that can run commands or change the server or its data (BLOCKED_METHODS), or a statement separator (;). Methods are blocked whether they are called with parentheses or accessed like a property, since MVEL calls no argument methods for both.

MVEL.eval can evaluate any expression, so only the legacy MVEL.eval("toUpperCase()", value) form generated by older versions of the rule builder is allowed.

String literals are removed before the check, read the same way MVEL reads them, so their contents are never mistaken for code.

The validation can be turned off with the mvel.expression.validation.enabled property. Methods can be blocked in addition to the built-in ones with the mvel.expression.validation.blocked.methods property, and built-in ones can be allowed with the mvel.expression.validation.allowed.methods property, e.g. for custom fields with the same name as a blocked method. This class is a bean only so that the properties can be injected.

  • Constructor Details

    • MvelExpressionValidator

      protected MvelExpressionValidator()

  • Method Details

    • setEnabled

      @Value("${mvel.expression.validation.enabled:true}") public void setEnabled(boolean enabled)

    • setBlockedMethods

      @Value("${mvel.expression.validation.blocked.methods:}") public void setBlockedMethods(String blockedMethods)
      Parameters:
      blockedMethods - comma separated method names to block in addition to the built-in ones

    • setAllowedMethods

      @Value("${mvel.expression.validation.allowed.methods:}") public void setAllowedMethods(String allowedMethods)
      Parameters:
      allowedMethods - comma separated built-in blocked method names to allow, e.g. for custom fields that have the same name as a blocked method

    • isAllowed

      public static boolean isAllowed(String expression)
      Checks the expression and logs a warning if it is not allowed. A null expression is allowed, the same as an empty one, since there is no rule.
      Parameters:
      expression - the MVEL expression exactly as it will be compiled
      Returns:
      true if the expression may be compiled and executed