# AccessControlUtils.java

    /*
     * Copyright (c) 2024, WSO2 LLC. (http://www.wso2.com).
     *
     * WSO2 LLC. licenses this file to you under the Apache License,
     * Version 2.0 (the "License"); you may not use this file except
     * in compliance with the License.
     * You may obtain a copy of the License at
     *
     * http://www.apache.org/licenses/LICENSE-2.0
     *
     * Unless required by applicable law or agreed to in writing,
     * software distributed under the License is distributed on an
     * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
     * KIND, either express or implied.  See the License for the
     * specific language governing permissions and limitations
     * under the License.
     */

    package org.apache.synapse.mediators.bsf.access.control;

    import java.util.Comparator;
    import java.util.List;

    import org.apache.synapse.script.access.AccessControlConfig;
    import org.apache.synapse.script.access.AccessControlListType;
    import org.graalvm.polyglot.Context;
    import org.graalvm.polyglot.EnvironmentAccess;
    import org.graalvm.polyglot.HostAccess;
    import org.graalvm.polyglot.Value;

    /**
     * Utility methods related to Script Mediator access control.
     */
    public class AccessControlUtils {

        /**
         * Returns whether the provided string which represents a Java class or native object is accessible or not.
         * The allowing/blocking will be determined by the provided AccessControlConfig, based on the matching/comparing
         * done as specified in the comparator.
         * @param string                Java class name or native object name.
         * @param accessControlConfig   Access control config of the Script Mediator.
         * @param comparator            The comparator based on which, the provided Java class/native object name is
         *                              matched against the provided access control config.
         * @return                      Whether the access is allowed or not.
         */
        public static boolean isAccessAllowed(String string, AccessControlConfig accessControlConfig,
                                              Comparator<String> comparator) {
            if (accessControlConfig == null || !accessControlConfig.isAccessControlEnabled()) {
                return true; // Access control is not applicable
            }

            List<String> accessControlList = accessControlConfig.getAccessControlList();
            boolean doesMatchExist = false;
            for (String item : accessControlList) {
                if (comparator.compare(string, item) > -1) {
                    doesMatchExist = true;
                    break;
                }
            }

            if (accessControlConfig.getAccessControlListType() == AccessControlListType.BLOCK_LIST) {
                return !doesMatchExist;
            }
            if (accessControlConfig.getAccessControlListType() == AccessControlListType.ALLOW_LIST) {
                return doesMatchExist;
            }
            return true; // Ideally we won't reach here
        }

        /**
         * Creates a GraalVM Context.Builder with security restrictions applied as per the provided
         * AccessControlConfig.
         * Since we have used Nashorn compatibility mode, we need to allow experimental options and set the other parameters
         * as below which were the defaults when using the GraalJSEngineFactory directly.
         *
         * @param classAccessControlConfig Access control config related to Java class access
         * @return Context.Builder with security restrictions applied
         */
        public static Context.Builder createSecureGraalContext(AccessControlConfig classAccessControlConfig) {

            Context.Builder builder = Context.newBuilder("js")
                    .allowExperimentalOptions(true)
                    .option("js.syntax-extensions", "true")
                    .option("js.load", "true")
                    .option("js.script-engine-global-scope-import", "true")
                    .option("js.charset", "UTF-8")
                    .option("js.global-arguments", "true")
                    .option("js.print", "true")
                    .allowEnvironmentAccess(EnvironmentAccess.INHERIT)
                    .useSystemExit(true)
                    .allowAllAccess(true)
                    .allowHostAccess(createNashornHostAccess())
                    .allowHostClassLookup(s -> isAccessAllowed(s, classAccessControlConfig, new Comparator<String>() {
                        @Override
                        public int compare(String o1, String o2) {

                            if (o1 != null && o1.startsWith(o2)) {
                                return 0;
                            }
                            return -1;
                        }
                    }));
            return builder;
        }

        private static HostAccess createNashornHostAccess() {

            HostAccess.Builder b = HostAccess.newBuilder(HostAccess.ALL);
            b.targetTypeMapping(Value.class, String.class, (v) -> {
                return !v.isNull();
            }, (v) -> {
                return toString(v);
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            b.targetTypeMapping(Number.class, Integer.class, (n) -> {
                return true;
            }, (n) -> {
                return n.intValue();
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            b.targetTypeMapping(Number.class, Double.class, (n) -> {
                return true;
            }, (n) -> {
                return n.doubleValue();
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            b.targetTypeMapping(Number.class, Long.class, (n) -> {
                return true;
            }, (n) -> {
                return n.longValue();
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            b.targetTypeMapping(Number.class, Boolean.class, (n) -> {
                return true;
            }, (n) -> {
                return toBoolean(n.doubleValue());
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            b.targetTypeMapping(String.class, Boolean.class, (n) -> {
                return true;
            }, (n) -> {
                return !n.isEmpty();
            }, HostAccess.TargetMappingPrecedence.LOWEST);
            return b.build();
        }

        private static String toString(Value value) {

            return toPrimitive(value).toString();
        }

        private static boolean isPrimitive(Value value) {

            return value.isString() || value.isNumber() || value.isBoolean() || value.isNull();
        }

        private static Value toPrimitive(Value value) {

            if (value.hasMembers()) {
                String[] var1 = new String[]{"toString", "valueOf"};
                int var2 = var1.length;

                for (int var3 = 0; var3 < var2; ++var3) {
                    String methodName = var1[var3];
                    if (value.canInvokeMember(methodName)) {
                        Value maybePrimitive = value.invokeMember(methodName, new Object[0]);
                        if (isPrimitive(maybePrimitive)) {
                            return maybePrimitive;
                        }
                    }
                }
            }
            if (isPrimitive(value)) {
                return value;
            } else {
                throw new ClassCastException();
            }
        }

        private static boolean toBoolean(double d) {

            return d != 0.0 && !Double.isNaN(d);
        }
    }