Package delight.nashornsandbox.internal
Class JsSanitizer
java.lang.Object
delight.nashornsandbox.internal.JsSanitizer
JavaScript sanitizer. Check for loops and inserts function call which breaks
script execution when JS engine thread is interrupted.
Created on 2017.11.22
- Version:
- $Id$
-
Nested Class Summary
Nested Classes -
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final boolean
true
when lack of braces is allowed.The beautify function search list.private static final String
The resource name of beautify.min.js script.The beautifier options.private static SoftReference
<String> Soft reference to the text of the js script.(package private) static final String
The name of the JS function to be inserted into user script.(package private) static final String
The name of the variable which holds reference to interruption checking class.JS beautify() function reference.Pattern for back braces.private static final List
<JsSanitizer.PoisonPil> private final ScriptEngine
private final SecuredJsCache
-
Constructor Summary
ConstructorsConstructorDescriptionJsSanitizer
(ScriptEngine scriptEngine, boolean allowBraces, SecuredJsCache cache) JsSanitizer
(ScriptEngine scriptEngine, int maxPreparedStatements, boolean allowBraces) -
Method Summary
Modifier and TypeMethodDescriptionprivate void
beautifierAsFunction
(Object beautifyScript) (package private) String
beautifyJs
(String js) (package private) void
checkBraces
(String beautifiedJs) After beautifier every braces should be in place, if not, or too many we need to prevent script execution.private void
private SecuredJsCache
createSecuredJsCache
(int maxPreparedStatements) private static Object
getBeautifHandler
(ScriptEngine scriptEngine) private static String
private String
(package private) String
private SecuredJsCache
newSecuredJsCache
(int maxPreparedStatements) private String
secureJsImpl
(String js)
-
Field Details
-
BEAUTIFY_JS
The resource name of beautify.min.js script.- See Also:
-
BEAUTIFY_FUNCTIONS
The beautify function search list. -
JS_INTERRUPTED_FUNCTION
The name of the JS function to be inserted into user script. To prevent collisions random suffix is added.- See Also:
-
JS_INTERRUPTED_TEST
The name of the variable which holds reference to interruption checking class. To prevent collisions random suffix is added.- See Also:
-
POISON_PILLS
-
BEAUTIFY_OPTIONS
The beautifier options. Don't change if you are not know what you are doing, because regexps are depended on it. -
beautifysScript
Soft reference to the text of the js script. -
scriptEngine
-
jsBeautify
JS beautify() function reference. -
securedJsCache
-
allowNoBraces
private final boolean allowNoBracestrue
when lack of braces is allowed. -
LACK_EXPECTED_BRACES
Pattern for back braces.
-
-
Constructor Details
-
JsSanitizer
JsSanitizer(ScriptEngine scriptEngine, int maxPreparedStatements, boolean allowBraces) -
JsSanitizer
JsSanitizer(ScriptEngine scriptEngine, boolean allowBraces, SecuredJsCache cache)
-
-
Method Details
-
assertScriptEngine
private void assertScriptEngine() -
getBeautifHandler
-
createSecuredJsCache
-
newSecuredJsCache
-
checkBraces
After beautifier every braces should be in place, if not, or too many we need to prevent script execution.- Parameters:
beautifiedJs
- evaluated script- Throws:
BracesException
- when braces are incorrect
-
injectInterruptionCalls
-
getPreamble
-
checkJs
-
secureJs
- Throws:
ScriptException
-
secureJsImpl
- Throws:
BracesException
-
beautifyJs
-
getBeautifyJs
-
beautifierAsFunction
-