Implementing Nashorn ClassFilter equivalent

ps0604 :

Using the nashorn library jdk.nashorn.api.scripting.* one can implement the ClassFilter interface to disable instantiating any class from within a javascript run in Java:

private static class NoJavaFilter implements ClassFilter {

    @Override
    public boolean exposeToScripts(String s) {
        return false;
    }
}

This works when you start the engine like so:

NashornScriptEngineFactory factory = new NashornScriptEngineFactory();
ScriptEngine nashorn = factory.getScriptEngine(new NoJavaFilter());

But I'm using built-in Java 8 javax.script library:

    ScriptEngineManager manager = new ScriptEngineManager();
    ScriptEngine engine = manager.getEngineByName("nashorn");

That doesn't have ClassFilter, any thoughts how to implement the equivalent?

UPDATE

This code runs in a Wildfly 14 EJB container. The JsUtils bean is injected in the invoker, that runs the run method sending the script as a parameter.

@Stateless
public class JsUtils {

    public String run(String script) throws ScriptException,
                                            NoSuchMethodException {     

        ScriptEngineManager manager = new ScriptEngineManager();
        ScriptEngine engine = manager.getEngineByName("nashorn");                  
        Object result = engine.eval(script);
        return result.toString();
    }
}
ps0604 :

Use the jdk.nashorn.api.scripting library, there's no other way

Guess you like

Origin http://43.154.161.224:23101/article/api/json?id=82873&siteId=1