BATIK-1345: Restrict what java classes can be run thru rhino

git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1904565 13f79535-47bb-0310-9956-ffa450edef68
apache · Oct 13, 2022 · 401aa85 · 401aa85
1 parent eada57c
commit 401aa85
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java b/batik-script/src/main/java/org/apache/batik/script/rhino/RhinoClassShutter.java
@@ -59,7 +59,7 @@ public void test(String cls) {
      * Returns whether the given class is visible to scripts.
      */
     public boolean visibleToScripts(String fullClassName) {
-        if (fullClassName.startsWith("java.") && !WHITELIST.contains(fullClassName) && !fullClassName.endsWith("Permission")) {
+        if (!WHITELIST.contains(fullClassName) && !fullClassName.endsWith("Permission") && !fullClassName.startsWith("org.")) {
             return false;
         }