moparisthebest/filebot
1
0
Fork 0
mirror of https://github.com/mitb-archive/filebot synced 2024-11-10 11:25:04 -05:00
Code Issues Releases Wiki Activity

Make sure that returned Closure objects are invoked in the AccessController context

Browse Source
This commit is contained in:
Reinhard Pointner 2017-01-16 15:11:34 +08:00
parent 7955d1bf6e
commit 2ba160c00d
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
source/net/filebot/format/SecureCompiledScript.java
View File

@ -15,6 +15,7 @@ import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction; import java.security.PrivilegedExceptionAction;
import java.security.ProtectionDomain; import java.security.ProtectionDomain;
import java.util.PropertyPermission; import java.util.PropertyPermission;
import java.util.concurrent.Callable;
import java.util.logging.LoggingPermission; import java.util.logging.LoggingPermission;
import javax.script.CompiledScript; import javax.script.CompiledScript;
@ -76,13 +77,23 @@ public class SecureCompiledScript extends CompiledScript {
} }
@Override @Override
public Object eval(final ScriptContext context) throws ScriptException { public Object eval(ScriptContext context) throws ScriptException {
try { try {
return AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() { return AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() {
@Override @Override
public Object run() throws ScriptException { public Object run() throws ScriptException {
return compiledScript.eval(context); Object value = compiledScript.eval(context);
if (value instanceof Callable<?>) {
try {
return ((Callable<?>) value).call();
} catch (Exception e) {
throw new ScriptException(e);
}
}
return value;
} }
}, sandbox); }, sandbox);
} catch (PrivilegedActionException e) { } catch (PrivilegedActionException e) {