Package com.stimulsoft.base.parser

Class StiSecureClassValidator

java.lang.Object

com.stimulsoft.base.parser.StiSecureClassValidator

public class StiSecureClassValidator
extends Object

Security validator to restrict access to dangerous classes and methods. Prevents arbitrary code execution via reflection. CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code CWE-470: Use of Externally-Controlled Input to Select Classes or Code

Constructor Summary

Constructors

Constructor	Description
StiSecureClassValidator()

Method Summary

Modifier and Type	Method	Description
static Set<String>	getAllowedClasses()	Returns the set of allowed classes for debugging and documentation.
static Set<String>	getBlockedClasses()	Returns the set of blocked classes for debugging and documentation.
static boolean	isPrimitiveType(String className)	Determines whether the class name corresponds to a primitive type or its wrapper.
static void	validateClass(String className)	Validates whether a class is allowed for use in scripts.
static void	validateConstructor(String className)	Validates whether instantiation of the specified class is allowed.
static void	validateField(String className, String fieldName)	Validates whether access to a field is allowed.
static void	validateMethod(String className, String methodName)	Validates whether a method is allowed on the specified class.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

StiSecureClassValidator

public StiSecureClassValidator()

Method Details

validateClass

public static void validateClass(String className)
                          throws StiCSharpScriptParser.ScriptSecurityException

Validates whether a class is allowed for use in scripts.

Parameters:

className - full class name

Throws:

StiCSharpScriptParser.ScriptSecurityException - if the class is not permitted

validateMethod

public static void validateMethod(String className,
 String methodName)
                           throws StiCSharpScriptParser.ScriptSecurityException

Validates whether a method is allowed on the specified class.

Parameters:

className - full class name

methodName - method name

Throws:

StiCSharpScriptParser.ScriptSecurityException - if the method is not permitted

validateField

public static void validateField(String className,
 String fieldName)
                          throws StiCSharpScriptParser.ScriptSecurityException

Validates whether access to a field is allowed.

Parameters:

className - full class name

fieldName - field name

Throws:

StiCSharpScriptParser.ScriptSecurityException - if field access is not permitted

validateConstructor

public static void validateConstructor(String className)
                                throws StiCSharpScriptParser.ScriptSecurityException

Validates whether instantiation of the specified class is allowed.

Parameters:

className - full class name

Throws:

StiCSharpScriptParser.ScriptSecurityException - if instantiation is prohibited

isPrimitiveType

public static boolean isPrimitiveType(String className)

Determines whether the class name corresponds to a primitive type or its wrapper.

Parameters:

className - full class name or primitive name

Returns:

true if it is a primitive type or wrapper

getAllowedClasses

public static Set<String> getAllowedClasses()

Returns the set of allowed classes for debugging and documentation.

Returns:

an unmodifiable set of allowed classes

getBlockedClasses

public static Set<String> getBlockedClasses()

Returns the set of blocked classes for debugging and documentation.

Returns:

an unmodifiable set of blocked classes