/**
* Find Security Bugs
* Copyright (c) Philippe Arteau, All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 3.0 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library.
*/
package testcode.script;
import javax.el.ELContext;
import javax.el.ExpressionFactory;
import javax.el.ValueExpression;
import javax.faces.context.FacesContext;
public class ElExpressionSample {
public void unsafeEL(String expression) {
FacesContext context = FacesContext.getCurrentInstance();
ExpressionFactory expressionFactory = context.getApplication().getExpressionFactory();
ELContext elContext = context.getELContext();
ValueExpression vex = expressionFactory.createValueExpression(elContext, expression, String.class);
String result = (String) vex.getValue(elContext);
System.out.println(result);
}
public void safeEL() {
FacesContext context = FacesContext.getCurrentInstance();
ExpressionFactory expressionFactory = context.getApplication().getExpressionFactory();
ELContext elContext = context.getELContext();
ValueExpression vex = expressionFactory.createValueExpression(elContext, "1+1", String.class);
String result = (String) vex.getValue(elContext);
System.out.println(result);
}
public void unsafeELMethod(ELContext elContext,ExpressionFactory expressionFactory, String expression) {
expressionFactory.createMethodExpression(elContext, expression, String.class, new Class[]{Integer.class});
}
public void safeELMethod(ELContext elContext,ExpressionFactory expressionFactory) {
expressionFactory.createMethodExpression(elContext, "1+1", String.class,new Class[] {Integer.class});
}
}