Use JXPathFilter based on the jxpath.allow.class system property

This has the additional benefit of not breaking the binary compatibility of the Functions interface
apache · Oct 19, 2022 · 4ae80cb · 4ae80cb
1 parent 021b8ce
commit 4ae80cb
Show file tree

Hide file tree

Showing 11 changed files with 210 additions and 256 deletions.
diff --git a/src/main/java/org/apache/commons/jxpath/ClassFunctions.java b/src/main/java/org/apache/commons/jxpath/ClassFunctions.java
@@ -92,17 +92,8 @@ public Function getFunction(
         final String namespace,
         final String name,
         Object[] parameters) {
-        return getFunction(namespace, name, parameters, new JXPathFilter());
-    }
-
-    public Function getFunction(
-            String namespace,
-            String name,
-            Object[] parameters,
-            JXPathFilter jxPathFilter) {
-
-        // give chance to ClassFilter to filter out, if present
-        if (jxPathFilter != null && !jxPathFilter.exposeToXPath(functionClass.getName())) {
+        JXPathFilter jxPathFilter = new JXPathFilter();
+        if (!jxPathFilter.exposeToXPath(functionClass.getName())) {
             throw new JXPathException(
                     "Extension function is not allowed: " + (namespace != null ? namespace + ":" + name : name)
                     + " (in " + functionClass.getName() + ")");

diff --git a/src/main/java/org/apache/commons/jxpath/FunctionLibrary.java b/src/main/java/org/apache/commons/jxpath/FunctionLibrary.java
@@ -16,8 +16,6 @@
  */
 package org.apache.commons.jxpath;
 
-import org.apache.commons.jxpath.ri.JXPathFilter;
-
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -78,30 +76,12 @@ public Set getUsedNamespaces() {
     @Override
     public Function getFunction(final String namespace, final String name,
             final Object[] parameters) {
-        return getFunction(namespace, name, parameters, new JXPathFilter());
-    }
-
-    /**
-     * Returns a Function, if any, for the specified namespace,
-     * name and parameter types.
-     * @param namespace function namespace
-     * @param name function name
-     * @param parameters parameters
-     * @param jxPathFilter  the XPath filter
-     * @return Function found
-     */
-    public Function getFunction(
-            final String namespace,
-            final String name,
-            final Object[] parameters,
-            final JXPathFilter jxPathFilter) {
-        Object candidates = functionCache().get(namespace);
+        final Object candidates = functionCache().get(namespace);
         if (candidates instanceof Functions) {
             return ((Functions) candidates).getFunction(
                 namespace,
                 name,
-                parameters,
-                jxPathFilter);
+                parameters);
         }
         if (candidates instanceof List) {
             final List list = (List) candidates;
@@ -111,8 +91,7 @@ public Function getFunction(
                     ((Functions) list.get(i)).getFunction(
                         namespace,
                         name,
-                        parameters,
-                        jxPathFilter);
+                        parameters);
                 if (function != null) {
                     return function;
                 }

diff --git a/src/main/java/org/apache/commons/jxpath/Functions.java b/src/main/java/org/apache/commons/jxpath/Functions.java
@@ -45,15 +45,4 @@ public interface Functions {
      * @return Function
      */
     Function getFunction(String namespace, String name, Object[] parameters);
-
-    /**
-     * Returns a Function, if any, for the specified namespace,
-     * name and parameter types.
-     * @param namespace ns
-     * @param name function name
-     * @param parameters Object[]
-     * @param jxPathFilter  the XPath filter
-     * @return Function
-     */
-    Function getFunction(String namespace, String name, Object[] parameters, JXPathFilter jxPathFilter);
 }
diff --git a/src/main/java/org/apache/commons/jxpath/PackageFunctions.java b/src/main/java/org/apache/commons/jxpath/PackageFunctions.java
@@ -117,36 +117,6 @@ public Function getFunction(
         final String namespace,
         final String name,
         Object[] parameters) {
-        return getFunction(namespace, name, parameters, new JXPathFilter());
-    }
-
-    /**
-     * Returns a {@link Function}, if found, for the specified namespace,
-     * name and parameter types.
-     * <p>
-     * @param  namespace - if it is not the same as specified in the
-     * construction, this method returns null
-     * @param name - name of the method, which can one these forms:
-     * <ul>
-     * <li><b>methodname</b>, if invoking a method on an object passed as the
-     * first parameter</li>
-     * <li><b>Classname.new</b>, if looking for a constructor</li>
-     * <li><b>subpackage.subpackage.Classname.new</b>, if looking for a
-     * constructor in a subpackage</li>
-     * <li><b>Classname.methodname</b>, if looking for a static method</li>
-     * <li><b>subpackage.subpackage.Classname.methodname</b>, if looking for a
-     * static method of a class in a subpackage</li>
-     * </ul>
-     * @param parameters Object[] of parameters
-     * @param jxPathFilter  the XPath filter
-     * @return a MethodFunction, a ConstructorFunction or null if no function
-     * is found
-     */
-    public Function getFunction(
-        final String namespace,
-        final String name,
-        Object[] parameters,
-        final JXPathFilter jxPathFilter) {
         if (!Objects.equals(this.namespace, namespace)) {
             return null;
         }
@@ -216,7 +186,7 @@ public Function getFunction(
 
         Class functionClass;
         try {
-            functionClass = ClassLoaderUtil.getClass(className, true, jxPathFilter);
+            functionClass = ClassLoaderUtil.getClass(className, true);
         }
         catch (final ClassNotFoundException ex) {
             throw new JXPathException(

diff --git a/src/main/java/org/apache/commons/jxpath/ri/JXPathContextReferenceImpl.java b/src/main/java/org/apache/commons/jxpath/ri/JXPathContextReferenceImpl.java
@@ -765,7 +765,7 @@ public Function getFunction(final QName functionName, final Object[] parameters)
         while (funcCtx != null) {
             funcs = funcCtx.getFunctions();
             if (funcs != null) {
-                func = funcs.getFunction(namespace, name, parameters, new JXPathFilter());
+                func = funcs.getFunction(namespace, name, parameters);
                 if (func != null) {
                     return func;
                 }

diff --git a/src/main/java/org/apache/commons/jxpath/util/ClassLoaderUtil.java b/src/main/java/org/apache/commons/jxpath/util/ClassLoaderUtil.java
@@ -79,7 +79,7 @@ public static Class getClass(final ClassLoader classLoader, final String classNa
         Class clazz;
 
         // give chance to ClassFilter to filter out, if present
-        if (jxPathFilter != null && !jxPathFilter.exposeToXPath(className)) {
+        if (jxPathFilter == null || !jxPathFilter.exposeToXPath(className)) {
             throw new ClassNotFoundException(className);
         }
 
@@ -106,7 +106,7 @@ public static Class getClass(final ClassLoader classLoader, final String classNa
      */
     public static Class getClass(ClassLoader classLoader, String className, boolean initialize)
             throws ClassNotFoundException {
-        return getClass(classLoader, className, initialize, null);
+        return getClass(classLoader, className, initialize, new JXPathFilter());
     }
 
     /**
@@ -181,7 +181,7 @@ public static Class getClass(String className, JXPathFilter jxPathFilter) throws
      * @throws ClassNotFoundException if the class is not found
      */
     public static Class getClass(final String className, final boolean initialize) throws ClassNotFoundException {
-        return getClass(className, initialize, null);
+        return getClass(className, initialize, new JXPathFilter());
     }
 
     /**

diff --git a/src/test/java/org/apache/commons/jxpath/BasicNodeSetTest.java b/src/test/java/org/apache/commons/jxpath/BasicNodeSetTest.java
@@ -35,10 +35,17 @@ public class BasicNodeSetTest extends JXPathTestCase {
     @Override
     protected void setUp() throws Exception {
         super.setUp();
+        System.setProperty("jxpath.class.allow", "*");
         context = JXPathContext.newContext(new TestMixedModelBean());
         nodeSet = new BasicNodeSet();
     }
 
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty("jxpath.class.allow");
+        super.tearDown();
+    }
+
     /**
      * Add the pointers for the specified path to <code>nodeSet</code>.
      *

diff --git a/src/test/java/org/apache/commons/jxpath/issues/JXPath172DynamicTest.java b/src/test/java/org/apache/commons/jxpath/issues/JXPath172DynamicTest.java
@@ -36,6 +36,18 @@ public static TestSuite suite()
         return new TestSuite(JXPath172DynamicTest.class);
     }
 
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        System.setProperty("jxpath.class.allow", "*");
+    }
+
+    @Override
+    public void tearDown() throws Exception {
+        System.clearProperty("jxpath.class.allow");
+        super.tearDown();
+    }
+
     public void testIssue172_propertyExistAndIsNotNull()
     {
         final JXPathContext context = getContext("ciao", false);