apache · bhmohanr-techie · Oct 13, 2022
diff --git a/src/main/java/org/apache/commons/jxpath/ClassFunctions.java b/src/main/java/org/apache/commons/jxpath/ClassFunctions.java
@@ -23,6 +23,7 @@
 
 import org.apache.commons.jxpath.functions.ConstructorFunction;
 import org.apache.commons.jxpath.functions.MethodFunction;
+import org.apache.commons.jxpath.ri.JXPathFilter;
 import org.apache.commons.jxpath.util.MethodLookupUtils;
 
 /**
@@ -92,6 +93,28 @@ public Function getFunction(
         String namespace,
         String name,
         Object[] parameters) {
+        return getFunction(namespace, name, parameters, null);
+    }
+
+    public Function getFunction(
+            String namespace,
+            String name,
+            Object[] parameters,
+            JXPathFilter jxPathFilter) {
+
+        // give chance to ClassFilter to filter out, if present
+        try {
+            if (jxPathFilter != null && !jxPathFilter.exposeToXPath(functionClass.getName())) {
+                throw new ClassNotFoundException(functionClass.getName());
+            }
+        }
+        catch (ClassNotFoundException ex) {
+            throw new JXPathException(
+                    "Cannot invoke extension function "
+                            + (namespace != null ? namespace + ":" + name : name),
+                    ex);
+            }
+
         if (namespace == null) {
             if (this.namespace != null) {
                 return null;

diff --git a/src/main/java/org/apache/commons/jxpath/FunctionLibrary.java b/src/main/java/org/apache/commons/jxpath/FunctionLibrary.java
@@ -16,6 +16,8 @@
  */
 package org.apache.commons.jxpath;
 
+import org.apache.commons.jxpath.ri.JXPathFilter;
+
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -77,12 +79,30 @@ public Set getUsedNamespaces() {
      */
     public Function getFunction(String namespace, String name,
             Object[] parameters) {
+        return getFunction(namespace, name, parameters, null);
+    }
+
+    /**
+     * Returns a Function, if any, for the specified namespace,
+     * name and parameter types.
+     * @param namespace function namespace
+     * @param name function name
+     * @param parameters parameters
+     * @param jxPathFilter  the XPath filter
+     * @return Function found
+     */
+    public Function getFunction(
+            String namespace,
+            String name,
+            Object[] parameters,
+            JXPathFilter jxPathFilter) {
         Object candidates = functionCache().get(namespace);
         if (candidates instanceof Functions) {
             return ((Functions) candidates).getFunction(
                 namespace,
                 name,
-                parameters);
+                parameters,
+                jxPathFilter);
         }
         if (candidates instanceof List) {
             List list = (List) candidates;
@@ -92,7 +112,8 @@ public Function getFunction(String namespace, String name,
                     ((Functions) list.get(i)).getFunction(
                         namespace,
                         name,
-                        parameters);
+                        parameters,
+                        jxPathFilter);
                 if (function != null) {
                     return function;
                 }

diff --git a/src/main/java/org/apache/commons/jxpath/Functions.java b/src/main/java/org/apache/commons/jxpath/Functions.java
@@ -16,6 +16,8 @@
  */
 package org.apache.commons.jxpath;
 
+import org.apache.commons.jxpath.ri.JXPathFilter;
+
 import java.util.Set;
 
 /**
@@ -46,4 +48,15 @@ public interface Functions {
      * @return Function
      */
     Function getFunction(String namespace, String name, Object[] parameters);
+
+    /**
+     * Returns a Function, if any, for the specified namespace,
+     * name and parameter types.
+     * @param namespace ns
+     * @param name function name
+     * @param parameters Object[]
+     * @param jxPathFilter  the XPath filter
+     * @return Function
+     */
+    Function getFunction(String namespace, String name, Object[] parameters, JXPathFilter jxPathFilter);
 }
diff --git a/src/main/java/org/apache/commons/jxpath/PackageFunctions.java b/src/main/java/org/apache/commons/jxpath/PackageFunctions.java
@@ -25,6 +25,7 @@
 
 import org.apache.commons.jxpath.functions.ConstructorFunction;
 import org.apache.commons.jxpath.functions.MethodFunction;
+import org.apache.commons.jxpath.ri.JXPathFilter;
 import org.apache.commons.jxpath.util.ClassLoaderUtil;
 import org.apache.commons.jxpath.util.MethodLookupUtils;
 import org.apache.commons.jxpath.util.TypeUtils;
@@ -112,10 +113,41 @@ public Set getUsedNamespaces() {
      * @return a MethodFunction, a ConstructorFunction or null if no function
      * is found
      */
+    public Function getFunction(
+            String namespace,
+            String name,
+            Object[] parameters) {
+        return getFunction(namespace, name, parameters, null);
+    }
+
+    /**
+     * Returns a {@link Function}, if found, for the specified namespace,
+     * name and parameter types.
+     * <p>
+     * @param  namespace - if it is not the same as specified in the
+     * construction, this method returns null
+     * @param name - name of the method, which can one these forms:
+     * <ul>
+     * <li><b>methodname</b>, if invoking a method on an object passed as the
+     * first parameter</li>
+     * <li><b>Classname.new</b>, if looking for a constructor</li>
+     * <li><b>subpackage.subpackage.Classname.new</b>, if looking for a
+     * constructor in a subpackage</li>
+     * <li><b>Classname.methodname</b>, if looking for a static method</li>
+     * <li><b>subpackage.subpackage.Classname.methodname</b>, if looking for a
+     * static method of a class in a subpackage</li>
+     * </ul>
+     * @param parameters Object[] of parameters
+     * @param jxPathFilter  the XPath filter
+     * @return a MethodFunction, a ConstructorFunction or null if no function
+     * is found
+     */
     public Function getFunction(
         String namespace,
         String name,
-        Object[] parameters) {
+        Object[] parameters,
+        JXPathFilter jxPathFilter) {
+
         if ((namespace == null && this.namespace != null) //NOPMD
             || (namespace != null && !namespace.equals(this.namespace))) {
             return null;
@@ -186,7 +218,7 @@ public Function getFunction(
 
         Class functionClass;
         try {
-            functionClass = ClassLoaderUtil.getClass(className, true);
+            functionClass = ClassLoaderUtil.getClass(className, true, jxPathFilter);
         }
         catch (ClassNotFoundException ex) {
             throw new JXPathException(

diff --git a/src/main/java/org/apache/commons/jxpath/ri/JXPathClassFilter.java b/src/main/java/org/apache/commons/jxpath/ri/JXPathClassFilter.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.jxpath.ri;
+
+/**
+ * Class filter (optional) to be used by JXPath.
+ *
+ * System property "jxpath.class.deny" can be set to specify the list of restricted classnames.
+ * This property takes a list of java classnames (use comma as separator to specify more than one class).
+ * If this property is not set, it exposes any java class to javascript
+ * Ex: jxpath.class.deny=java.lang.Runtime will deny exposing java.lang.Runtime class via xpath, while all other classes will be exposed.
+ *
+ * @author bhmohanr-techie
+ * @version $Revision$ $Date$
+ */
+public interface JXPathClassFilter {
+
+    /**
+     * Should the Java class of the specified name be exposed via xpath?
+     * @param className is the fully qualified name of the java class being
+     * checked. This will not be null. Only non-array class names will be
+     * passed.
+     * @return true if the java class can be exposed via xpath, false otherwise
+     */
+    public boolean exposeToXPath(String className);
+}
diff --git a/src/main/java/org/apache/commons/jxpath/ri/JXPathContextReferenceImpl.java b/src/main/java/org/apache/commons/jxpath/ri/JXPathContextReferenceImpl.java
@@ -27,23 +27,10 @@
 import java.util.Vector;
 import java.util.Map.Entry;
 
-import org.apache.commons.jxpath.CompiledExpression;
-import org.apache.commons.jxpath.ExceptionHandler;
-import org.apache.commons.jxpath.Function;
-import org.apache.commons.jxpath.Functions;
-import org.apache.commons.jxpath.JXPathContext;
-import org.apache.commons.jxpath.JXPathException;
-import org.apache.commons.jxpath.JXPathFunctionNotFoundException;
-import org.apache.commons.jxpath.JXPathInvalidSyntaxException;
-import org.apache.commons.jxpath.JXPathNotFoundException;
-import org.apache.commons.jxpath.JXPathTypeConversionException;
-import org.apache.commons.jxpath.Pointer;
+import org.apache.commons.jxpath.*;
 import org.apache.commons.jxpath.ri.axes.InitialContext;
 import org.apache.commons.jxpath.ri.axes.RootContext;
-import org.apache.commons.jxpath.ri.compiler.Expression;
-import org.apache.commons.jxpath.ri.compiler.LocationPath;
-import org.apache.commons.jxpath.ri.compiler.Path;
-import org.apache.commons.jxpath.ri.compiler.TreeCompiler;
+import org.apache.commons.jxpath.ri.compiler.*;
 import org.apache.commons.jxpath.ri.model.NodePointer;
 import org.apache.commons.jxpath.ri.model.NodePointerFactory;
 import org.apache.commons.jxpath.ri.model.VariablePointerFactory;
@@ -739,7 +726,7 @@ public Function getFunction(QName functionName, Object[] parameters) {
         while (funcCtx != null) {
             funcs = funcCtx.getFunctions();
             if (funcs != null) {
-                func = funcs.getFunction(namespace, name, parameters);
+                func = funcs.getFunction(namespace, name, parameters, new JXPathFilter());
                 if (func != null) {
                     return func;
                 }

diff --git a/src/main/java/org/apache/commons/jxpath/ri/JXPathFilter.java b/src/main/java/org/apache/commons/jxpath/ri/JXPathFilter.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.jxpath.ri;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+
+/**
+ * A filter to be used by JXPath, to evaluate the xpath string values to impose any restrictions.
+ * This class implements specific filter interfaces, and implements methods in those. 
+ * For instance, it JXPathClassFilter interface, which is used to check if any restricted java classes are passed via xpath
+ * JXPath uses this filter instance when an extension function instance is created.
+ *
+ * @author bhmohanr-techie
+ * @version $Revision$ $Date$
+ */
+public class JXPathFilter implements JXPathClassFilter {
+    ArrayList<String> restrictedClassesList = null;
+
+    public JXPathFilter() {
+        init();
+    }
+
+    public void init() {
+        String restrictedClasses = System.getProperty("jxpath.class.deny");
+        restrictedClassesList = null;
+        if ((restrictedClasses != null) && (restrictedClasses.trim().length() > 0)) {
+            restrictedClassesList = new ArrayList<String>();
+            restrictedClassesList.addAll(Arrays.asList(restrictedClasses.split(",")));
+        }
+    }
+
+    /**
+     * Specifies whether the Java class of the specified name be exposed via xpath
+     *
+     * @param className is the fully qualified name of the java class being checked.
+     *                  This will not be null. Only non-array class names will be passed.
+     * @return true if the java class can be exposed via xpath, false otherwise
+     */
+    @Override
+    public boolean exposeToXPath(String className) {
+        if ((restrictedClassesList == null) || (restrictedClassesList.size() < 1) ||  restrictedClassesList.contains("*")) {
+            return true;
+        }
+
+        if (restrictedClassesList.contains(className)) {
+            return false;
+        }
+
+        return true;
+    }
+}
+