Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
/**
* This file is part of VisiCut.
* Copyright (C) 2011 - 2013 Thomas Oster <thomas.oster@rwth-aachen.de>
* RWTH Aachen University - 52062 Aachen, Germany
*
* VisiCut is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* VisiCut is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with VisiCut. If not, see <http://www.gnu.org/licenses/>.
**/
package com.t_oster.liblasercut.laserscript;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.Reader;
import java.io.StringReader;
import javax.script.ScriptException;
import sun.org.mozilla.javascript.Context;
import sun.org.mozilla.javascript.ContextFactory;
import sun.org.mozilla.javascript.NativeJavaObject;
import sun.org.mozilla.javascript.Scriptable;
import sun.org.mozilla.javascript.WrapFactory;
/**
* This class provides a JavaScript interpreter which is pretty sandboxed.
* The only accessible stuff are the methods "move/line/get/set from the provided
* ScriptInterface object).
*
* The sandboxing code is taken from:
* http://codeutopia.net/blog/2009/01/02/sandboxing-rhino-in-java/
*
* @author Thomas Oster <thomas.oster@rwth-aachen.de>
*/
public class ScriptInterpreter
{
public static class SandboxNativeJavaObject extends NativeJavaObject {
public SandboxNativeJavaObject(Scriptable scope, Object javaObject, Class staticType) {
super(scope, javaObject, staticType);
}
@Override
public Object get(String name, Scriptable start) {
//don't allow the getClass method
if (name.equals("getClass")) {
System.err.println("ScriptingSecurity: LaserScript tried to access 'getClass'");
return NOT_FOUND;
}
return super.get(name, start);
}
}
public static class SandboxWrapFactory extends WrapFactory {
@Override
public Scriptable wrapAsJavaObject(Context cx, Scriptable scope, Object javaObject, Class staticType) {
return new SandboxNativeJavaObject(scope, javaObject, staticType);
}
}
public class SandboxContextFactory extends ContextFactory {
@Override
protected Context makeContext() {
Context cx = super.makeContext();
cx.setWrapFactory(new SandboxWrapFactory());
return cx;
}
}
public void execute(String script, ScriptInterface si) throws ScriptException, IOException
{
this.execute(new StringReader(script), si, true);
}
public void execute(final Reader script, final ScriptInterface si) throws ScriptException, IOException
{
this.execute(script, si, true);
}
public void execute(String script, ScriptInterface si, boolean sandbox) throws ScriptException, IOException
{
this.execute(new StringReader(script), si, sandbox);
}
public void execute(final Reader script, final ScriptInterface si, boolean sandbox) throws ScriptException, IOException
{
if (!ContextFactory.hasExplicitGlobal())
{
ContextFactory.initGlobal(new SandboxContextFactory());
}
Context cx = ContextFactory.getGlobal().enterContext();
try
{
cx.setClassShutter(ScriptingSecurity.getInstance());
}
catch (SecurityException e)
{
//already registered for the current thread....
}
// Scriptable represents the script environment
Scriptable scope = cx.initStandardObjects(null);
scope.put("_instance", scope, Context.toObject(si, scope));
ScriptingSecurity.getInstance().setLocked(false);
cx.evaluateReader(scope, new InputStreamReader(this.getClass().getResourceAsStream("LaserScriptBootstrap.js")), "LaserScriptBootstrap.js", -1, null);
ScriptingSecurity.getInstance().setLocked(sandbox);
try
{
cx.evaluateReader(scope, script, "laserscript", -1, null);
}
catch (Exception e)
{
if (e instanceof ScriptException)
{
throw (ScriptException) e;
}
else
{
throw new ScriptException(e);
}
}
}
}