Adds host access setting to allow instantiation of Java classes in a …

…scripting context at runtime.
structr · May 22, 2024 · facb36a · facb36a
1 parent 51668cd
commit facb36a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/structr-base/src/main/java/org/structr/core/script/polyglot/context/ContextFactory.java b/structr-base/src/main/java/org/structr/core/script/polyglot/context/ContextFactory.java
@@ -40,8 +40,7 @@ public abstract class ContextFactory {
  .engine(engine)
  .allowPolyglotAccess(AccessProvider.getPolyglotAccessConfig())
  .allowHostAccess(AccessProvider.getHostAccessConfig())
- // TODO: Add config switch to toggle Host Class Lookup
- //.allowHostClassLookup(new StructrClassPredicate())
+ .allowHostClassLookup(s -> Settings.AllowedHostClasses.getValue("").contains(s))
  .allowIO(AccessProvider.getIOAccessConfig())
  .allowExperimentalOptions(true)
  .option("js.foreign-object-prototype", "true")
@@ -62,8 +61,8 @@ public abstract class ContextFactory {
  .allowPolyglotAccess(AccessProvider.getPolyglotAccessConfig())
  .allowHostAccess(AccessProvider.getHostAccessConfig())
  .allowIO(AccessProvider.getIOAccessConfig())
- .allowHostAccess(AccessProvider.getHostAccessConfig());
- //.allowHostClassLookup(new StructrClassPredicate());
+ .allowHostAccess(AccessProvider.getHostAccessConfig())
+ .allowHostClassLookup(s -> Settings.AllowedHostClasses.getValue("").contains(s));
 
  public static String getDebuggerPath() {
 

diff --git a/structr-db-driver-api/src/main/java/org/structr/api/config/Settings.java b/structr-db-driver-api/src/main/java/org/structr/api/config/Settings.java
@@ -101,6 +101,8 @@ public enum POSSIBLE_UUID_V4_FORMATS {
  // scripting related settings
  public static final Setting<Boolean> ScriptingDebugger = new BooleanSetting(generalGroup, "Scripting", "application.scripting.debugger", false, "Enables <b>Chrome</b> debugger initialization in scripting engine. The current debugger URL will be shown in the server log and also made available on the dashboard.");
 
+ public static final Setting<String> AllowedHostClasses = new StringSetting(generalGroup, "Scripting", "application.scripting.allowedhostclasses", "", "Space-separated list of fully-qualified Java class names that you can load dynamically in a scripting environment.");
+
  // clustering
  public static final Setting<Boolean> ClusterModeEnabled = new BooleanSetting(generalGroup, "Application", "application.cluster.enabled", false, "Enables cluster mode (experimental)");
  public static final Setting<String> ClusterName = new StringSetting(generalGroup, "Application", "application.cluster.name", "structr", "The name of the Structr cluster");