tree 247fc8508b233d8e556b8adf745299bd84f925be
parent 7c8144a589df75487512b1c920ad3ba145ff9b18
author Serge Huber <shuber@jahia.com> 1597928860 +0200
committer GitHub <noreply@github.com> 1597928860 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJfPnWcCRBK7hj4Ov3rIwAAdHIIADppiB5Pap4az5DPl+UZyyJ7
 GatoEoMROvMC7OPXtDPUb7XwjU0P+FdBVW8AB0TBHwpejeC2DFZLvCje+USCmDs+
 6/SkMPS68ZiIvSZDVJ9N7/1/andSuZ3DlbKrIyAEbdvubxEosLB9a8BIkgE+PUtZ
 ppEZ6bYtxX8mwwhcLHURIuuNwFly1vdGR4xwtLjItBlpmsVdCvzw9SChwiylvPhY
 dJbUGOUDpTaxvdT0ONS/9fjHka8DNa0PpAChXAH2H0bWwEZslyHu6Ft+TFTaeswm
 +7RHEiXYcY1rMEi3+ysn0Q9E6+HuCfDCHUkZ6h1s8hHufqVibOCHRmmCIPVK0+A=
 =xCrR
 -----END PGP SIGNATURE-----
 

Improve scripting security (#179)

* Improve scripting security:
- OGNL is now disabled by default as it wasn't really used much (possible to reactive through a system setting)
- A new condition sanitizer has been added in the ContextServlet to filter out any MVEL scripts (again not used much and can be reactivate using a system property)
- A new ExpressionFilter has been added that will use configurable (system property) regular expressions to filter out possible malicious expressions
- OGNL sandboxing has been improved
- MVEL default imports have been modified to prevent using system-level classes

* Fix bug in sanitizing code

* New scripting execution sub-system:
- Allow-listing of allowed expressions
- Plugins may deployed their own allow-lists using JSON files
- OGNL scripting is now deactivated by default
- Minimal list of built-in MVEL allowed patterns

* Fix typo in marker