javavariable-assignmentjexl

How to disable JEXL assignments?


I have an application that allows users to enter JEXL expressions. They are used as search filters. A common mistake users do is to write something like "A=5" and expect the filter to be true if and only if the variable A contains the value 5.

Yes, you are right: the = operator is the assignment, and users should have used == for comparison. A workaround like rejecting expressions that match the regular expression [^=]=[^=] would also not allow to compare strings like A=="foo=bar" so it is not the solution.

Is there a chance to remove the assignment operator from a JexlEngine via runtime configuration so it would throw an Exception during parse? Or alternatively find out that the JexlExpression contains an assignment?


Solution

  • So it looks like the JEXL API does not offer any access to the syntax tree or to define the allowed operators. What helped me so far was to modify my implementation of the JexlContext.

    By overriding the set method to throw an Exception at least I get an error during runtime. I'd still prefer to have an error at parse-time of the expression, but it saves the day.