[JEXL-375] Cannot access enums by their name when using sandbox

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.2.1
• Fix Version/s: 3.3
• Assignee: Henri Biestro
• Reporter: Jan Klička
• Created: 13/Jul/22 06:52
• Updated: 27/Mar/23 10:59
• Resolved: 24/Jul/22 14:26

Description

Hello,

 

when using sandbox, accessing enum value via the dot notation fails with an exception `JexlException$Property: JexlTest.addressTypeTest:186 undefined property 'DOMICILE'`.

 

The only workaround I have found was to use the `valueOf` method on the enum.

 

I tried tracking down the cause. I believe the issue lies in `SandboxUberspect.getPropertyGet` on line

`final String actual = sandbox.read(obj.getClass(), property)`

where obj is the class of the enum, and thus the permission gets read for `Class<Object>` (result of `obj.getClass()`) instead of the enum.

 

Contrast this to the code in `Uberspect.getPropertyGet` , where it tries to also resolve against `obj`, not only its superclass.

```

executor = FieldGetExecutor.discover(is, claz, property);
// static class fields (enums included)
if (obj instanceof Class<?>)

{    executor = FieldGetExecutor.discover(is, (Class<?>) obj, property); }

```

 

Here is unit test demonstrating this issue.

 

@Test
public void addressTypeTest() {
    JexlSandbox jexlSandbox = new JexlSandbox(false);
    jexlSandbox.allow(Type.class.getName());

    JexlEngine engine = new JexlBuilder()
            .sandbox(jexlSandbox)
            .create();

    var context = new HashMap<String, Object>();
    context.put("Type", Type.class);

    Type typeValueOf = (Type) engine.createScript(
            "return Type.valueOf('DOMICILE');\n"
    ).execute(new MapContext(context));
    assertEquals(Type.DOMICILE, typeValueOf);

    Type typeDirect = (Type) engine.createScript(
            "return Type.DOMICILE;\n"
    ).execute(new MapContext(context));
    assertEquals(Type.DOMICILE, typeDirect);
}

public enum Type {
    DELIVERY_ADDRESS,
    DOMICILE
}