Menu
▾
▴
jython-dev
|
From: <Chr...@ge...> - 2001-08-31 15:04:42
|
Hi Folks,
we are currently trying to use Jython to give users the possibility to
enter python scripts to automate some steps in a Java application we are
developing. We want to provide the users an API with Java Classes. But we
want to restrict the user that he can only use these public Classes from
the API. For this we first set Options.respectJavaAccessibility to true. To
be able to restrict the user to the API the introduced a new interface
JavaAccessInterceptor and made some small changes to class PyJavaClass.
Mainly a new method setJavaAccessInterceptor(JavaAccessInterceptor
anInterceptor) to set an interceptor and a call of the interceptor in the
methods getAccessibleConstructors, getAccessibleFields and
getAccessibleMethods.
I did this changes in the python version 2.0. but I think it is also
possible in the version 2.1a3.
We think the change can be useful for other jython users and would like if
you are able to ingrate the changes or provide something similar.
What do you think about this ?
Probably it would be better to call the interceptor also in the case when
Options.respectJavaAccessibility is set to false.....
Regards
Christian.
(See attached file: src.jar)
|
|
From: Kevin B. <kb...@ca...> - 2001-08-31 17:31:50
|
How does this relate to Python's restricted execution mode? It seems there would be substantial overlap, but I haven't ever tried using rexec in Jython... http://py-howto.sourceforge.net/rexec/rexec.html kb Chr...@ge... wrote: > > Hi Folks, > > we are currently trying to use Jython to give users the possibility to > enter python scripts to automate some steps in a Java application we are > developing. We want to provide the users an API with Java Classes. But we > want to restrict the user that he can only use these public Classes from > the API. For this we first set Options.respectJavaAccessibility to true. To > be able to restrict the user to the API the introduced a new interface > JavaAccessInterceptor and made some small changes to class PyJavaClass. > Mainly a new method setJavaAccessInterceptor(JavaAccessInterceptor > anInterceptor) to set an interceptor and a call of the interceptor in the > methods getAccessibleConstructors, getAccessibleFields and > getAccessibleMethods. > > I did this changes in the python version 2.0. but I think it is also > possible in the version 2.1a3. > > We think the change can be useful for other jython users and would like if > you are able to ingrate the changes or provide something similar. > What do you think about this ? > > Probably it would be better to call the interceptor also in the case when > Options.respectJavaAccessibility is set to false..... > > Regards > Christian. > > (See attached file: src.jar) > > ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > Name: src.jar > src.jar Type: application/zip > Encoding: base64 > Description: .ZIP File |
|
From: Ype K. <yk...@xs...> - 2001-09-01 09:06:59
|
Kevin, >How does this relate to Python's restricted execution mode? > >It seems there would be substantial overlap, but I haven't ever tried using rexec in Jython... > >http://py-howto.sourceforge.net/rexec/rexec.html Unfortunately, the rexec module is not available in jython. Ype. >kb > >Chr...@ge... wrote: >> >> Hi Folks, >> >> we are currently trying to use Jython to give users the possibility to >> enter python scripts to automate some steps in a Java application we are >> developing. We want to provide the users an API with Java Classes. But we >> want to restrict the user that he can only use these public Classes from >> the API. For this we first set Options.respectJavaAccessibility to true. To >> be able to restrict the user to the API the introduced a new interface >> JavaAccessInterceptor and made some small changes to class PyJavaClass. >> Mainly a new method setJavaAccessInterceptor(JavaAccessInterceptor >> anInterceptor) to set an interceptor and a call of the interceptor in the >> methods getAccessibleConstructors, getAccessibleFields and >> getAccessibleMethods. >> >> I did this changes in the python version 2.0. but I think it is also >> possible in the version 2.1a3. >> >> We think the change can be useful for other jython users and would like if >> you are able to ingrate the changes or provide something similar. >> What do you think about this ? >> >> Probably it would be better to call the interceptor also in the case when >> Options.respectJavaAccessibility is set to false..... >> >> Regards >> Christian. >> >> (See attached file: src.jar) >> > > |
|
From: <bc...@wo...> - 2001-09-04 19:05:33
|
[Christian Pape] >Hi Folks, > >we are currently trying to use Jython to give users the possibility to >enter python scripts to automate some steps in a Java application we are >developing. We want to provide the users an API with Java Classes. But we >want to restrict the user that he can only use these public Classes from >the API. Just to make sure that I understand: you want to add further restrictions than the normal java access modifiers. Your java classes have public methods which you do *not* want the users to call. Right? How would your application decide which methods to restrict? Do you expect this feature to be truely secure? Or is it mainly a way of hiding unwanted methods from eyes of the casual user? >For this we first set Options.respectJavaAccessibility to true. As you note later, a hook into the access check should not be tied together with the respectJavaAccessibility flag. It is two different things. >To >be able to restrict the user to the API the introduced a new interface >JavaAccessInterceptor and made some small changes to class PyJavaClass. >Mainly a new method setJavaAccessInterceptor(JavaAccessInterceptor >anInterceptor) to set an interceptor and a call of the interceptor in the >methods getAccessibleConstructors, getAccessibleFields and >getAccessibleMethods. I don't like the patch in its current form. Setting an intercepter is too global and the java API (PyJavaClass.setJavaAccessInterceptor) simply sucks. I think the java API should set the interceptor on the PySystemState instance. That should be the right place for this kind of information and it will allow an independent system state to run without an interceptor or with a different interceptor. >I did this changes in the python version 2.0. but I think it is also >possible in the version 2.1a3. > >We think the change can be useful for other jython users and would like if >you are able to ingrate the changes or provide something similar. >What do you think about this ? If there are others that could use such a feature, please raise your hand. >Probably it would be better to call the interceptor also in the case when >Options.respectJavaAccessibility is set to false..... Right. regards, finn |
