Java EXpression Language (JEXL) is a simple expression language provided by the Apache Commons JEXL library. The syntax is close to a mix of ECMAScript and shell-script. The language allows invocation of methods available in the JVM. If a JEXL expression is built using attacker-controlled data, and then evaluated, then it may allow the attacker to run arbitrary code.
It is generally recommended to avoid using untrusted input in a JEXL expression. If it is not possible, JEXL expressions should be run in a sandbox that allows accessing only explicitly allowed classes.
The following example uses untrusted data to build and run a JEXL expression.
The next example shows how an untrusted JEXL expression can be run
in a sandbox that allows accessing only methods in the java.lang.Math class.
The sandbox is implemented using JexlSandbox class that is provided by
Apache Commons JEXL 3.
The next example shows another way how a sandbox can be implemented.
It uses a custom implementation of JexlUberspect
that checks if callees are instances of allowed classes.