MVELSafeHelper { public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; } private  MVELSafeHelper(); static MVELEvaluator getEvaluator();  }
@Test public void testUntrustedJavaConsequence() throws Exception { try { MVELSafeHelper.getEvaluator().eval("System.exit(0);"); Assert.fail("Should have raised an exception..."); } catch (ShouldHavePrevented e) { Assert.fail("The security policy for the rule should have prevented this from executing..."); } catch (PropertyAccessException e) { } }
@Test public void testReflectionAttack() throws Exception { String setup = "java.lang.reflect.Field field = org.drools.core.util.MVELSafeHelper.getDeclaredField(\"evaluator\");\n" + "System.out.println(field);\n" + "field.setAccessible(true);\n" + "field.set(null, \"new org.drools.core.util.MVELSafeHelper.RawMVELEvaluator()\");"; try { Assert.assertEquals( SafeMVELEvaluator.class.getName(), MVELSafeHelper.getEvaluator().getClass().getName() ); MVELSafeHelper.getEvaluator().eval(setup, new HashMap<String,Object>()); Assert.fail("Should have raised an AccessControlException"); } catch (PropertyAccessException e) { } }