Package com.xebialabs.xlrelease.script

Class Jsr223ScriptExecutor

java.lang.Object
com.xebialabs.xlrelease.script.Jsr223ScriptExecutor
All Implemented Interfaces:
ScriptExecutor
Direct Known Subclasses:
JythonScriptExecutor
public abstract class Jsr223ScriptExecutor extends Object implements ScriptExecutor

  • Field Details

    • logger

      protected final org.slf4j.Logger logger

    • unrestrictedEngine

      protected ScriptEngine unrestrictedEngine

    • restrictedEngine

      protected ScriptEngine restrictedEngine

    • scriptPermissionsProvider

      protected ScriptPermissionsProvider scriptPermissionsProvider

  • Constructor Details

  • Method Details

    • evalScript

      public Object evalScript(XlrScriptContext xlrScriptContext) throws Exception
      Specified by:
      evalScript in interface ScriptExecutor
      Throws:
      Exception

    • evalScriptPrivileged

      protected abstract Object evalScriptPrivileged(ScriptEngine engine, String script, ScriptContext scriptContext, AccessControlContext accessControlContext, boolean checkPolicyPermissions) throws Exception
      Throws:
      Exception

    • doPrivileged

      protected Object doPrivileged(ScriptEngine engine, String script, ScriptContext scriptContext, AccessControlContext accessControlContext) throws Exception
      Throws:
      Exception

    • isScriptSandboxEnabled

      protected Boolean isScriptSandboxEnabled()

    • getWorkDir

      protected String getWorkDir()

    • getAccessControlContext

      protected AccessControlContext getAccessControlContext()

    • buildEffectiveScriptPermissions

      protected PermissionCollection buildEffectiveScriptPermissions()
      Builds the effective class-access permission set for a restricted script (code-built grants plus any configured script permissions). Used both to construct the AccessControlContext on JVMs that still support the Security Manager, and to evaluate class access in-process on JDK 24+ (JEP 486), where it is carried by ScriptSandboxContext.

    • allowedClasses

      protected Collection<String> allowedClasses()
      Classes granted to restricted scripts on top of the built-in allow-list. Overridden by the concrete executor from config.

    • deniedClasses

      protected Collection<String> deniedClasses()
      Classes revoked for restricted scripts. Overridden by the concrete executor from config.

    • createMinimalPermissions

      protected Permissions createMinimalPermissions()

    • addJavaPrimitivesPermissions

      protected void addJavaPrimitivesPermissions(Permissions minimalPermissions)

    • addInternalAccessPermissions

      protected void addInternalAccessPermissions(Permissions minimalPermissions)

    • addJythonLibrariesReadPermissions

      protected void addJythonLibrariesReadPermissions(Permissions minimalPermissions)

    • addGroovyLibrariesReadPermissions

      protected void addGroovyLibrariesReadPermissions(Permissions minimalPermissions)

    • addJsonModule

      protected void addJsonModule(Permissions permissions)

    • addCiUtilsPermissions

      protected void addCiUtilsPermissions(Permissions permissions)

    • addJsonSmartLibraryPermissions

      protected void addJsonSmartLibraryPermissions(Permissions minimalPermissions)

    • addJavaHomeSecurityLibPermissions

      protected void addJavaHomeSecurityLibPermissions(Permissions minimalPermissions)

    • addReadPermissionOnJar

      protected void addReadPermissionOnJar(List<String> jarNames, Permissions minimalPermissions)

    • addReadPermissionOnPluginsFolder

      protected void addReadPermissionOnPluginsFolder(Permissions minimalPermissions)

    • resolvePermissionIfNecessary

      protected Permission resolvePermissionIfNecessary(Permission permission)

    • configureSandboxAndGetEngine

      protected ScriptEngine configureSandboxAndGetEngine(boolean checkPolicyPermissions)
      This method sets threadlocal "sandbox" property that is later used by SandboxAwarePackageManager to restrict packages (class namespaces) that are accessible

    • reloadScriptEngines

      public void reloadScriptEngines()

    • isRestricted

      protected boolean isRestricted(boolean checkPolicyPermissions)