How to pass Javascript native types to Nashorn objects from Java?

Question

For security reasons I'd like to pass to JS functions in Nashorn native Java types.

If I create an engine and I run the following:

        NashornScriptEngineFactory nashornScriptEngineFactory = new      NashornScriptEngineFactory();
        ScriptEngine engine = nashornScriptEngineFactory.getScriptEngine();
        engine.eval(script);
        Invocable invocable = (Invocable) engine;
        JSObject objectWork = (JSObject) engine.get("objectWork");
        objectWork.call(null,"eee");

with script being

function objectWork(arg){
   print ("arg is "+ typeof arg);
   print ("arg.getClass()"+ arg.getClass());

   for (var k in arg){
        print(k);
   }
}

The output is

arg is string
arg.getClass()class java.lang.String

I'm not so happy about the 2nd and I don't know if getClass is exposing any method of the java.lang.Class object. Is there a way to pass something that wraps the Java String in a native one extending Nashorn own JSObject?

It is possible to extend JSObject but I'm not sure it's a good idea. This class is under jdk.* packages. — Tunaki
– Tunaki, Commented Sep 26, 2015 at 13:02
I've seen it, but I don't see any obvious way to make it a js string, just a regular object with properties. Furthermore it does not have any is* method for primitive types, like Number String, etc... — gotch4
– gotch4, Commented Sep 26, 2015 at 13:05

A. Sundararajan · Accepted Answer · 2015-09-28 04:28:01Z

JS String primitive type values are java.lang.String objects. For example,

jjs> "hello".getClass()
class java.lang.String
jjs> "hello".class
class java.lang.String

i.e., there is no separate "JS String" type used in nashorn. Nashorn tries to avoid wrapping Java/JS types as much as possible.

What is the specific issue you're worried about? Reflective access to String via "Class" object? Please note that by default Java reflection is not allowed to scripts if you run under SecurityManager.

$ jjs -J-Djava.security.manager
jjs> "hello".class
class java.lang.String
jjs> "hello".class.getMethods()
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "nashorn.JavaReflection")
jjs>

So, unless you give "nashorn.JavaReflection" RuntimePermission to a script, it won't be able to do any Java reflection from script. So, getting access to Class object of any Java object won't pose any security thread.

gotch4 · Accepted Answer · 2015-09-27 11:03:15Z

0

A trivial, yet working solution. Just have the engine load a piece of JS code like

function strclone(str){
 return new String(str);
}

and then call it from Java everytime. That will result in a JSObject and in a propert JS string that can be passed to JS functions:

JSObject strclone = (JSObject) engine.get("strclone");
JSObject jsString = strclone.call(null,"some Java string");
someOtherJsMethod.call(null, jsString);

answered Sep 27, 2015 at 11:03

gotch4

13.3k29 gold badges112 silver badges180 bronze badges

Collectives™ on Stack Overflow

How to pass Javascript native types to Nashorn objects from Java?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related