nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Sandboxing script task

robi_m

Spring app with Activiti engine embedded runs server-side. I need to secure (sandbox) user-defined scripts deployed on demand. The only Activiti-related doc I found describes how to limit ScriptTask's Spring beans visibility (=white list) but this is obviously not enough - e.g. a malicious user can just import Java io and read sensitive info etc., etc.

Thoughts?

Find more posts tagged with

Comments

frederikherema1

You'll need to see what's possible in the JSR-223 spec for sandboxing. Activiti leverages that spec to execute scripts. Take a look at the org.activiti.engine.impl.scripting.ScriptingEngines class. You can create a subclass of this and plug it in using the processEngineConfiguration. This subclass can do additional set-up of the script-bindings or any funny stuff you want to do. If this is not sufficient, you can rip out all functionality and return a customised (sandboxed) version of ScriptEngine and Bindings.