Compatibility with previous release

Version 3.7.0 is source and binary compatible with 3.6.x but it changes default runtime and parse-time behavior.

Compatibility with older releases (< 3.7)

Since 3.7.0 the default permissions are SECURE (was RESTRICTED since 3.3) and the default features disable new(...), global side-effects, pragmas, and annotations (lexical scoping is enabled; loops remain available to scripts). Because features are enforced at parse time, existing scripts that use a disabled construct will throw JexlException.Feature when compiled against a 3.7 engine built with the default settings.

Despite the obvious inconvenience - our sincere apologies on the matter -, how much functional and semantic power is accessible through scripts has a real impact on your application security and stability; that potential risk requires an informed review and conscious choice on your end. Whether Files, URLs, networking, processes, class-loaders or reflection classes or whether loops or side effects are accessible may be used as ingress points for nefarious usage.

The fastest mitigation is to load the bundled jexl.yaml configuration (see JexlConfigLoader) which restores RESTRICTED permissions and enables new, loops, side-effects, and lambdas:

try (InputStream in = getClass().getResourceAsStream("/jexl.yaml")) {
    JexlEngine engine = JexlConfigLoader.load(in).create();
}
      

To discover which reflective elements the new SECURE permissions now deny in your workload, wrap your permission set with JexlPermissions.logging() before constructing the engine: each allow/deny decision is logged once.

As another mitigation approach, you can revert to the previous behaviors with a few lines of code (see JexlPermissions, JexlFeatures, JexlBuilder and JexlScriptEngine ).

Compatibility with older releases (< 3.3, 2.x)

Since 3.3 release, the default setting for permissions that determine which packages, classes and methods are accessible to scripts has been reduced to a very narrow set. When migrating from previous version of JEXL, this may result in breaking your application behavior ; this breaking change requires remediation in your code.

Despite the obvious inconvenience - our sincere apologies on the matter -, how much functional and semantic power is accessible through scripts has a real impact on your application security and stability ; that potential risk requires an informed review and conscious choice on your end.

What is new in 3.7.0:

JEXL 3.7.0 hardens the default security posture of the engine. Two defaults change:

• The default permissions become JexlPermissions.SECURE — a minimum allow-list covering only safe java.lang value types, java.math, and java.util. Everything else (system classes, I/O, reflection, ...) is denied unless explicitly composed in.
• The default feature set disables new(...), global side-effects, pragmas, and annotations, and enables lexical scoping; loops remain available to scripts (but never to expressions). Scripts using a disabled construct will throw JexlException.Feature at parse time.

The RESTRICTED permission set was also hardened: a class is now accessible only when its own package or class is explicitly permitted — access is no longer granted because a super-type or interface sits in an allowed package (the former "reach-through"), which previously exposed the entire foreign class.

The new JexlPermissions.logging() wrapper logs every allow/deny decision (each distinct decision logged once) and is the recommended diagnostic when migrating.

The permissions DSL gained the ability to deny individual members (such as a constructor) of an otherwise-allowed class, e.g. "java.util +{ -Formatter { Formatter(); } }".

A new JexlConfigLoader lets applications load engine configuration from a YAML file, including permissions (SECURE/RESTRICTED/UNRESTRICTED + compose rules), features, and namespaces.

New Features in 3.7.0:

Bugs fixed in 3.7.0:

What was new in 3.6.3:

JEXL 3.6.3 is a minor release that fixes some bugs. It does not introduce any breaking change.

Bugs fixed in 3.6.3:

Changes in 3.6.3:

What was new in 3.6.2:

JEXL 3.6.2 was a minor release that fixed some bugs. It did not introduce any breaking change.

Bugs fixed in 3.6.2:

Changes in 3.6.2:

What was new in 3.6.1:

JEXL 3.6.1 was a minor release that fixed some bugs. It did not introduce any breaking change.

Bugs fixed in 3.6.1:

Changes in 3.6.1:

What was new in 3.6.0:

JEXL 3.6.0 introduced a switch statement and expressions (JEXL-440). It was a minor release that did not introduce any breaking change.

New Features in 3.6.0:

Bugs fixed in 3.6.0:

Changes in 3.6.0: