commit 19192fa8b9169379e28609f13076a8125d22ed9f
author Simon Steiner <ssteiner@apache.org> Thu Oct 27 12:52:08 2022 +0000
committer Simon Steiner <ssteiner@apache.org> Thu Oct 27 12:52:08 2022 +0000
tree 76c40c328e9bbc947d59f08efff1b0755a392bc5
parent 052b201c4b3422dbc4d054e574359dbfa5512c2b

BATIK-1346: Allow configuration of rhino whitelist

git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1904885 13f79535-47bb-0310-9956-ffa450edef68

batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java

diff --git a/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java b/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java
index 307affa..5a11d56 100644
--- a/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java
+++ b/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java
@@ -20,6 +20,7 @@
 
 import org.mozilla.javascript.ClassShutter;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
@@ -30,7 +31,10 @@
  * @version $Id$
  */
 public class RhinoClassShutter implements ClassShutter {
-    private static final List<String> WHITELIST = Arrays.asList("java.io.PrintStream", "java.lang.System", "java.net.URL");
+    public static final List<String> WHITELIST = new ArrayList<>();
+    static {
+        WHITELIST.addAll(Arrays.asList("java.io.PrintStream", "java.lang.System", "java.net.URL"));
+    }
 
     /*
     public RhinoClassShutter() {

batik-test-old/src/test/java/org/apache/batik/script/rhino/RhinoClassShutterTest.java

diff --git a/batik-test-old/src/test/java/org/apache/batik/script/rhino/RhinoClassShutterTest.java b/batik-test-old/src/test/java/org/apache/batik/script/rhino/RhinoClassShutterTest.java
index 2e2a413..d8a9f68 100644
--- a/batik-test-old/src/test/java/org/apache/batik/script/rhino/RhinoClassShutterTest.java
+++ b/batik-test-old/src/test/java/org/apache/batik/script/rhino/RhinoClassShutterTest.java
@@ -24,6 +24,10 @@
 public class RhinoClassShutterTest {
     @Test
     public void testImports() {
-        Assert.assertFalse(new RhinoClassShutter().visibleToScripts("java.lang.Runtime"));
+        String runtimeClass = "java.lang.Runtime";
+        Assert.assertFalse(new RhinoClassShutter().visibleToScripts(runtimeClass));
+        RhinoClassShutter.WHITELIST.add(runtimeClass);
+        Assert.assertTrue(new RhinoClassShutter().visibleToScripts(runtimeClass));
+        RhinoClassShutter.WHITELIST.remove(runtimeClass);
     }
 }