|
Compatibility with previous releaseVersion 3.4 is source and binary compatible with 3.3. Compatibility with older releases (< 3.3, 2.x)Since 3.3 release, the default setting for permissions that determine which packages, classes and methods are accessible to scripts has been reduced to a very narrow set. When migrating from previous version of JEXL, this may result in breaking your application behavior ; this breaking change requires remediation in your code. Despite the obvious inconvenience - our sincere apologies on the matter -, how much functional and semantic power is accessible through scripts has a real impact on your application security and stability ; that potential risk requires an informed review and conscious choice on your end. To mitigate the change, you can revert to the previous behavior with one line of code (see JexlPermissions, JexlBuilder and JexlScriptEngine ) or use this opportunity to reduce exposure. Whether Files, URLs, networking, processes, class-loaders or reflection classes or whether loops or side effects are accessible are part of your choice to make. What's new in 3.4:Features and permissions are easier to define through new methods. Some new syntaxes are introduced ; try/catch/finally (including with resources), an array-access safe navigation ((x?[y]), strict equality/inequality operators (===, !==), instanceof/!instanceof operators and more permissive structured literals. New Features in 3.4:
Bugs Fixed in 3.4:
|