henrib opened a new pull request, #413:
URL: https://github.com/apache/commons-jexl/pull/413
## Summary
Follow-up to #409 (JEXL-468): after the `copy()` overrides that preserve
`NOJEXL_CLASS`/`NOJEXL_PACKAGE` singletons through the map copy, one gap
remained.
**Root cause**: When `compose()` is called with rules that reference a
package previously stored as `NOJEXL_PACKAGE` (e.g. `"com.example.internal
{}"`) and those rules add class-specific exceptions,
`PermissionsParser.readPackages()` replaced the sentinel with a plain
`NoJexlPackage`. A plain `NoJexlPackage.getNoJexl(clazz)` returns `null` for
unlisted classes, which `deny(Class)` maps to `JEXL_CLASS` — every class in the
formerly-denied package silently became accessible.
## Changes
- **`Permissions.java`**: Add `DenyAllPackage` — a `NoJexlPackage` subclass
whose `getNoJexl()` returns `NOJEXL_CLASS` for any class not explicitly listed
(deny-first, symmetric to `JexlPackage`'s allow-first).
- **`PermissionsParser.java`**: In `readPackages().compute()`, when the
existing entry is `NOJEXL_PACKAGE` or `DenyAllPackage` and no explicit polarity
sign is present in the compose source, create `DenyAllPackage` instead of
`NoJexlPackage`.
- **`ComposePermissionsTest.java`**: Add
`testComposePreservesPackageDenialWithException` — asserts that `URL` stays
denied after `URI` is explicitly allowed in a previously-NOJEXL_PACKAGE
package, and that RESTRICTED class-level denials (Thread, Runtime) survive a
`java.lang` compose.
## Test plan
- [ ] `mvn -Dtest=ComposePermissionsTest test` — 6 tests pass
- [ ] `mvn
-Dtest="ComposePermissionsTest,PermissionsTest,NoJexlTest,SandboxTest" test` —
50+ tests pass
🤖 Generated with [Claude Code](https://claude.ai/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
