Mercurial Hosting > luan
changeset 229:2a54cb7d1cf4
improve security
git-svn-id: https://luan-java.googlecode.com/svn/trunk@230 21e917c8-12df-6dd8-5cb6-c86387c605b9
| author | fschmidt@gmail.com <fschmidt@gmail.com@21e917c8-12df-6dd8-5cb6-c86387c605b9> |
|---|---|
| date | Wed, 24 Sep 2014 21:13:46 +0000 |
| parents | 7580379cdc79 |
| children | 4438cb2e04d0 |
| files | build.sh core/src/luan/init.luan core/src/luan/modules/JavaLuan.java core/src/luan/modules/PackageLuan.java dist/luan-core-trunk.jar dist/luan-logging-trunk.jar dist/luan-mail-trunk.jar dist/luan-web-trunk.jar logging/src/luan/modules/logging/Logging.luan mail/src/luan/modules/mail/Mail.luan |
| diffstat | 10 files changed, 22 insertions(+), 41 deletions(-) [+] |
line wrap: on
line diff
--- a/build.sh Wed Sep 24 03:39:34 2014 +0000 +++ b/build.sh Wed Sep 24 21:13:46 2014 +0000 @@ -26,8 +26,16 @@ cd $HOME SRC=logging/src -CLASSPATH=$HOME/core/src:$HOME/$SRC -for i in $HOME/web/ext/* ; do CLASSPATH=$CLASSPATH:$i ; done +#CLASSPATH=$HOME/core/src:$HOME/$SRC +#for i in $HOME/logging/ext/* ; do CLASSPATH=$CLASSPATH:$i ; done #javac -classpath $CLASSPATH `find $SRC -name *.java` cd $SRC jar cvf $HOME/dist/luan-logging-$VERSION.jar `find . -name *.class -o -name *.luan` + +cd $HOME +SRC=mail/src +CLASSPATH=$HOME/core/src:$HOME/$SRC +for i in $HOME/mail/ext/* ; do CLASSPATH=$CLASSPATH:$i ; done +javac -classpath $CLASSPATH `find $SRC -name *.java` +cd $SRC +jar cvf $HOME/dist/luan-mail-$VERSION.jar `find . -name *.class -o -name *.luan`
--- a/core/src/luan/init.luan Wed Sep 24 03:39:34 2014 +0000 +++ b/core/src/luan/init.luan Wed Sep 24 21:13:46 2014 +0000 @@ -39,22 +39,6 @@ do_file "java:luan/version.luan" -function Package.block(mod_name) - local fn,path = Package.search(mod_name) - if path == nil then - error("module '"..mod_name.."' not found") - end - Package.block_path(path) -end - -function Package.is_blocked(mod_name) - local fn,path = Package.search(mod_name) - if path == nil then - error("module '"..mod_name.."' not found") - end - return Package.is_blocked_path(path) -end - function Io.print_to(out,...) local list = {} for _,v in Basic.values(...) do
--- a/core/src/luan/modules/JavaLuan.java Wed Sep 24 03:39:34 2014 +0000 +++ b/core/src/luan/modules/JavaLuan.java Wed Sep 24 21:13:46 2014 +0000 @@ -28,9 +28,12 @@ public final class JavaLuan { public static final LuanFunction LOADER = new LuanFunction() { - @Override public Object call(LuanState luan,Object[] args) { + @Override public Object call(LuanState luan,Object[] args) throws LuanException { + if( PackageLuan.is_blocked(luan,"Java") ) + throw luan.exception("Java is blocked"); LuanTable module = Luan.newTable(); try { + module.put( "block", new LuanJavaFunction(JavaLuan.class.getMethod("block",LuanState.class),null) ); module.put( "class", new LuanJavaFunction(JavaLuan.class.getMethod("getClass",LuanState.class,String.class),null) ); add( module, "proxy", LuanState.class, Static.class, LuanTable.class, Object.class ); } catch(NoSuchMethodException e) { @@ -69,6 +72,10 @@ } } + public static void block(LuanState luan) { + PackageLuan.block(luan,"Java"); + } + public static Object __index(LuanState luan,Object obj,Object key) throws LuanException { if( obj instanceof Static ) { if( key instanceof String ) {
--- a/core/src/luan/modules/PackageLuan.java Wed Sep 24 03:39:34 2014 +0000 +++ b/core/src/luan/modules/PackageLuan.java Wed Sep 24 21:13:46 2014 +0000 @@ -26,8 +26,6 @@ module.put( "jpath", jpath ); try { module.put("require",requireFn); - add( module, "block_path", LuanState.class, String.class ); - add( module, "is_blocked_path", LuanState.class, String.class ); add( module, "load", LuanState.class, String.class ); add( module, "load_lib", LuanState.class, String.class ); add( module, "search_path", String.class, String.class ); @@ -197,19 +195,17 @@ }; - public static void block_path(LuanState luan,String path) { - blocked(luan).put(path,true); + public static void block(LuanState luan,String key) { + blocked(luan).put(key,true); } - public static boolean is_blocked_path(LuanState luan,String path) { - return blocked(luan).get(path) != null; + public static boolean is_blocked(LuanState luan,String key) { + return blocked(luan).get(key) != null; } public static LuanFunction load_lib(LuanState luan,String path) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException, LuanException { - if( is_blocked_path(luan,path) ) - throw luan.exception(path+" is blocked"); int i = path.lastIndexOf('.'); String clsPath = path.substring(0,i); String fld = path.substring(i+1);
--- a/logging/src/luan/modules/logging/Logging.luan Wed Sep 24 03:39:34 2014 +0000 +++ b/logging/src/luan/modules/logging/Logging.luan Wed Sep 24 21:13:46 2014 +0000 @@ -1,10 +1,3 @@ -import "Package" - -if Package.is_blocked "logging/Logging" then - error "Logging is blocked" -end - - import "Java" import "org.apache.log4j.Logger" import "org.apache.log4j.EnhancedPatternLayout"
--- a/mail/src/luan/modules/mail/Mail.luan Wed Sep 24 03:39:34 2014 +0000 +++ b/mail/src/luan/modules/mail/Mail.luan Wed Sep 24 21:13:46 2014 +0000 @@ -1,10 +1,3 @@ -import "Package" - -if Package.is_blocked "mail/Mail" then - error "Mail is blocked" -end - - import "Java" import "java.lang.System" import "luan.modules.mail.SmtpCon"