Merge pull request #16 from Instancify/v1.4.0

feat: upcoming 1.4.0 update

Author: MEFRREEX

README.md

@@ -1,6 +1,10 @@
 # Instancify Scriptify
 Instancify Scriptify is a library to evaluate scripts written in JavaScript with ability to add global functions and variables.
 
+## What is it for?
+This library is designed to execute JavaScript scripts and has the ability to register global functions and constants.
+It also allows you to configure security for executing scripts.
+
 ## Maven
 Adding repo:
 ```xml
@@ -17,7 +21,7 @@ For adding a library only:
 <dependency>
     <groupId>com.instancify.scriptify</groupId>
     <artifactId>core</artifactId>
-    <version>1.3.6-SNAPSHOT</version>
+    <version>1.4.0-SNAPSHOT</version>
 </dependency>
 ```
 
@@ -26,12 +30,12 @@ For adding a library with JS for Rhino or GraalVM:
 <dependency>
     <groupId>com.instancify.scriptify</groupId>
     <artifactId>script-js-rhino</artifactId>
-    <version>1.3.6-SNAPSHOT</version>
+    <version>1.4.0-SNAPSHOT</version>
 </dependency>
 <dependency>
     <groupId>com.instancify.scriptify</groupId>
     <artifactId>script-js-graalvm</artifactId>
-    <version>1.3.6-SNAPSHOT</version>
+    <version>1.4.0-SNAPSHOT</version>
 </dependency>
 ```
 ## Gradle
@@ -45,11 +49,11 @@ maven {
 
 For adding a library only:
 ```groovy
-implementation "com.instancify.scriptify:core:1.3.6-SNAPSHOT"
+implementation "com.instancify.scriptify:core:1.4.0-SNAPSHOT"
 ```
 
 For adding a library with JS for Rhino or GraalVM:
 ```groovy
-implementation "com.instancify.scriptify:script-js-rhino:1.3.6-SNAPSHOT"
-implementation "com.instancify.scriptify:script-js-graalvm:1.3.6-SNAPSHOT"
+implementation "com.instancify.scriptify:script-js-rhino:1.4.0-SNAPSHOT"
+implementation "com.instancify.scriptify:script-js-graalvm:1.4.0-SNAPSHOT"
 ```

api/src/main/java/com/instancify/scriptify/api/script/security/ScriptSecurityManager.java

@@ -22,6 +22,13 @@ public interface ScriptSecurityManager {
      */
     void setSecurityMode(boolean securityMode);
 
+    /**
+     * Receives security file system.
+     *
+     * @return Security file system
+     */
+    SecurityFileSystem getFileSystem();
+
     /**
      * Receives security path accessor.
      *

api/src/main/java/com/instancify/scriptify/api/script/security/SecurityFileSystem.java

@@ -0,0 +1,34 @@
+package com.instancify.scriptify.api.script.security;
+
+import java.io.File;
+import java.nio.file.Path;
+
+/**
+ * Provides secure access to files and paths, ensuring
+ * all operations are restricted to the configured base path.
+ */
+public interface SecurityFileSystem {
+
+    /**
+     * Returns a secure Path inside the base path.
+     *
+     * @param path the path string to resolve
+     * @return a normalized and secure Path
+     * @throws SecurityException if the path is outside basePath or not accessible
+     */
+    Path getPath(String path);
+
+    /**
+     * Returns a secure File inside the base path.
+     *
+     * @param path the path string to resolve
+     * @return a normalized and secure File
+     * @throws SecurityException if the path is outside basePath or not accessible
+     */
+    File getFile(String path);
+
+    /**
+     * Returns the base path for this file system.
+     */
+    Path getBasePath();
+}

build.gradle.kts

@@ -12,7 +12,7 @@ java {
 
 allprojects {
     group = "com.instancify.scriptify"
-    version = "1.3.7-SNAPSHOT"
+    version = "1.4.0-SNAPSHOT"
 }
 
 subprojects {

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionDeleteFile.java

@@ -30,14 +30,14 @@ public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws Scr
         }
 
         if (args.length == 1) {
-            return new File(filePath).delete();
+            return script.getSecurityManager().getFileSystem().getFile(filePath).delete();
         }
 
         if (!(args[1].getValue() instanceof Boolean recursive)) {
             throw new ScriptFunctionArgTypeException(Boolean.class, args[1].getType());
         }
 
-        File file = new File(filePath);
+        File file = script.getSecurityManager().getFileSystem().getFile(filePath);
         if (recursive) {
             return deleteDirectoryRecursively(file);
         } else {

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionDownloadFromUrl.java

@@ -11,7 +11,8 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.net.URL;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.file.Files;
 
 /**
@@ -37,11 +38,11 @@ public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws Scr
             throw new ScriptFunctionArgTypeException(String.class, args[1].getType());
         }
 
-        try (InputStream in = new URL(url).openStream()) {
-            File targetPath = new File(filePath);
+        try (InputStream in = new URI(url).toURL().openStream()) {
+            File targetPath = script.getSecurityManager().getFileSystem().getFile(filePath);
             Files.copy(in, targetPath.toPath());
-        } catch (IOException e) {
-            e.printStackTrace();
+        } catch (IOException | URISyntaxException e) {
+            throw new RuntimeException(e);
         }
 
         return null;

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionExistsFile.java

@@ -25,7 +25,7 @@ public class ScriptFunctionExistsFile implements ScriptFunction {
     public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws ScriptFunctionException {
         if (args.length == 1) {
             if (args[0].getValue() instanceof String filePath) {
-                return Files.exists(Path.of(filePath));
+                return Files.exists(script.getSecurityManager().getFileSystem().getPath(filePath));
             } else {
                 throw new ScriptFunctionArgTypeException(String.class, args[0].getType());
             }

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionListFiles.java

@@ -9,8 +9,8 @@
 import org.jetbrains.annotations.NotNull;
 
 import java.io.File;
-import java.nio.file.Paths;
 import java.util.Arrays;
+import java.util.Objects;
 
 /**
  * Represents a function to get all files in a folder
@@ -26,9 +26,9 @@ public class ScriptFunctionListFiles implements ScriptFunction {
     public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws ScriptFunctionException {
         if (args.length == 1) {
             if (args[0].getValue() instanceof String filePath) {
-                File folder = Paths.get(filePath).toAbsolutePath().toFile();
+                File folder = script.getSecurityManager().getFileSystem().getFile(filePath);
                 if (folder.isDirectory()) {
-                    return Arrays.stream(folder.listFiles()).map(File::getAbsolutePath).toList();
+                    return Arrays.stream(Objects.requireNonNull(folder.listFiles())).map(File::getAbsolutePath).toList();
                 } else {
                     throw new ScriptFunctionException("File is not a folder");
                 }

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionMoveFile.java

@@ -33,7 +33,7 @@ public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws Scr
             throw new ScriptFunctionArgTypeException(String.class, args[1].getType());
         }
 
-        File fileToMove = new File(originalFilePath);
-        return fileToMove.renameTo(new File(targetFilePath));
+        File fileToMove = script.getSecurityManager().getFileSystem().getFile(originalFilePath);
+        return fileToMove.renameTo(script.getSecurityManager().getFileSystem().getFile(targetFilePath));
     }
 }

core/src/main/java/com/instancify/scriptify/core/script/function/impl/file/ScriptFunctionReadFile.java

@@ -27,7 +27,7 @@ public Object invoke(Script<?> script, ScriptFunctionArgument[] args) throws Scr
         if (args.length == 1) {
             if (args[0].getValue() instanceof String filePath) {
                 try {
-                    return Files.readString(Path.of(filePath));
+                    return Files.readString(script.getSecurityManager().getFileSystem().getPath(filePath));
                 } catch (IOException e) {
                     throw new ScriptFunctionException(e);
                 }