@Test public void testReflectionAttack() throws Exception { String setup = "java.lang.reflect.Field field = org.drools.core.util.MVELSafeHelper.getDeclaredField(\"evaluator\");\n" + "System.out.println(field);\n" + "field.setAccessible(true);\n" + "field.set(null, \"new org.drools.core.util.MVELSafeHelper.RawMVELEvaluator()\");"; try { Assert.assertEquals( SafeMVELEvaluator.class.getName(), MVELSafeHelper.getEvaluator().getClass().getName() ); MVELSafeHelper.getEvaluator().eval(setup, new HashMap<String,Object>()); Assert.fail("Should have raised an AccessControlException"); } catch (PropertyAccessException e) { } }
public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; }
MVELSafeHelper { public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; } }
MVELSafeHelper { public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; } private  MVELSafeHelper(); }
MVELSafeHelper { public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; } private  MVELSafeHelper(); static MVELEvaluator getEvaluator(); }
MVELSafeHelper { public static MVELEvaluator getEvaluator() { return MVELEvaluatorHolder.evaluator; } private  MVELSafeHelper(); static MVELEvaluator getEvaluator();  }