-
Notifications
You must be signed in to change notification settings - Fork 40
/
ProtectedFunctionMapper.java
186 lines (174 loc) · 6.58 KB
/
ProtectedFunctionMapper.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
/*
* Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
* Copyright 2004 The Apache Software Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.jasper.runtime;
import java.util.HashMap;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.security.PrivilegedExceptionAction;
import java.security.PrivilegedActionException;
import java.lang.reflect.Method;
import jakarta.el.FunctionMapper;
import org.apache.jasper.security.SecurityUtil;
/**
* Maps EL functions to their Java method counterparts. Keeps the
* actual Method objects protected so that JSP pages can't indirectly
* do reflection.
*
* @author Mark Roth
* @author Kin-man Chung
*/
public final class ProtectedFunctionMapper extends FunctionMapper {
/**
* Maps "prefix:name" to java.lang.Method objects.
*/
private HashMap<String, Method> fnmap = null;
/**
* If there is only one function in the map, this is the Method for it.
*/
private Method theMethod = null;
/**
* Constructor has protected access.
*/
private ProtectedFunctionMapper() {
}
/**
* Generated Servlet and Tag Handler implementations call this
* method to retrieve an instance of the ProtectedFunctionMapper.
* This is necessary since generated code does not have access to
* create instances of classes in this package.
*
* @return A new protected function mapper.
*/
public static ProtectedFunctionMapper getInstance() {
ProtectedFunctionMapper funcMapper;
if (SecurityUtil.isPackageProtectionEnabled()) {
funcMapper = AccessController.doPrivileged(
new PrivilegedAction<ProtectedFunctionMapper>() {
public ProtectedFunctionMapper run() {
return new ProtectedFunctionMapper();
}
} );
} else {
funcMapper = new ProtectedFunctionMapper();
}
funcMapper.fnmap = new java.util.HashMap<String, Method>();
return funcMapper;
}
/**
* Stores a mapping from the given EL function prefix and name to
* the given Java method.
*
* @param fnQName The EL function qualified name (including prefix)
* @param c The class containing the Java method
* @param methodName The name of the Java method
* @param args The arguments of the Java method
* @throws RuntimeException if no method with the given signature
* could be found.
*/
public void mapFunction(String fnQName, final Class<?> c,
final String methodName, final Class<?>[] args )
{
java.lang.reflect.Method method;
if (SecurityUtil.isPackageProtectionEnabled()){
try{
method = AccessController.doPrivileged(
new PrivilegedExceptionAction<Method>(){
public Method run() throws Exception{
return c.getDeclaredMethod(methodName, args);
}
});
} catch (PrivilegedActionException ex){
throw new RuntimeException(
"Invalid function mapping - no such method: "
+ ex.getException().getMessage());
}
} else {
try {
method = c.getDeclaredMethod(methodName, args);
} catch( NoSuchMethodException e ) {
throw new RuntimeException(
"Invalid function mapping - no such method: "
+ e.getMessage());
}
}
this.fnmap.put(fnQName, method );
}
/**
* Creates an instance for this class, and stores the Method for
* the given EL function prefix and name. This method is used for
* the case when there is only one function in the EL expression.
*
* @param fnQName The EL function qualified name (including prefix)
* @param c The class containing the Java method
* @param methodName The name of the Java method
* @param args The arguments of the Java method
* @throws RuntimeException if no method with the given signature
* could be found.
*/
public static ProtectedFunctionMapper getMapForFunction(
String fnQName, final Class<?> c,
final String methodName, final Class<?>[] args )
{
java.lang.reflect.Method method;
ProtectedFunctionMapper funcMapper;
if (SecurityUtil.isPackageProtectionEnabled()){
funcMapper = AccessController.doPrivileged(
new PrivilegedAction<ProtectedFunctionMapper>(){
public ProtectedFunctionMapper run() {
return new ProtectedFunctionMapper();
}
});
try{
method = AccessController.doPrivileged(
new PrivilegedExceptionAction<Method>(){
public Method run() throws Exception{
return c.getDeclaredMethod(methodName, args);
}
});
} catch (PrivilegedActionException ex){
throw new RuntimeException(
"Invalid function mapping - no such method: "
+ ex.getException().getMessage());
}
} else {
funcMapper = new ProtectedFunctionMapper();
try {
method = c.getDeclaredMethod(methodName, args);
} catch( NoSuchMethodException e ) {
throw new RuntimeException(
"Invalid function mapping - no such method: "
+ e.getMessage());
}
}
funcMapper.theMethod = method;
return funcMapper;
}
/**
* Resolves the specified local name and prefix into a Java.lang.Method.
* Returns null if the prefix and local name are not found.
*
* @param prefix the prefix of the function
* @param localName the short name of the function
* @return the result of the method mapping. Null means no entry found.
*/
public Method resolveFunction(String prefix, String localName) {
if (this.fnmap != null) {
return this.fnmap.get(prefix + ":" + localName);
}
return theMethod;
}
}