CDAP-21270: Enable JEXL expressions allowlisting in Wrangler Directives

[riyaa14]

Context

This PR introduces a JEXL allowlist mechanism to restrict which Java classes and methods can be invoked within JEXL expressions evaluated by Wrangler directives (e.g., filter, set-column, send-to-error). This enhances the security of JEXL evaluations by preventing arbitrary code execution.

The allowlist enforcement is controlled via the Feature.WRANGLER_JEXL_ALLOWLIST feature flag.

Key Changes

API Additions:
Introduced JexlAllowlist, DefaultJexlAllowlist, and DirectiveJexlAllowlist in wrangler-api to define the schema and default rules for allowed JEXL accesses.

Expression Compilation:
Added CompileOptions to wrangler-core to pass allowlist context and restrictions during JEXL expression compilation in EL.java.

Config Store Initialization: Updated ConfigStore with an initialize() method to populate the store with a default directive config (including DefaultJexlAllowlist) if none exists. Added custom GSON deserializers for parsing JexlAllowlist.

Version Bump: JEXL 3.0 to 3.1, this is compatible change, needed because 3.0 didn't support allowlist mode, we would have need to define a exclusion and inclusion list.

[gemini-code-assist]

Code Review

This pull request introduces a secure JEXL execution sandbox in Wrangler to restrict allowed classes, methods, and properties, updating various directives to compile expressions with sandbox rules and adding a comprehensive performance benchmark. The review feedback identifies several critical improvement opportunities, primarily focusing on preventing potential NullPointerExceptions in EL.java and JexlInclusion.java (especially when handling null JexlInfo or deserialized null fields). Additionally, the feedback points out a logic bug where the sandbox is incorrectly enforced even when the secure JEXL feature is disabled, and advises against committing user-specific absolute paths in .vscode/settings.json.

I am having trouble creating individual review comments. Click here to see my feedback.

wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java (156-175)

The info object returned by jexlEx.getInfo() can be null in some JexlException scenarios. Accessing info.getDetail(), info.getLine(), or info.getColumn() without a null check will throw a NullPointerException. Please add a null check for info before accessing its properties, similar to how it is handled in handleExecutionException.

    if (ex instanceof JexlException) {
      JexlException jexlEx = (JexlException) ex;
      JexlInfo info = jexlEx.getInfo();
      String detail = (info == null || info.getDetail() == null) ? expression : info.getDetail().toString();
      int line = info == null ? 0 : info.getLine();
      int column = info == null ? 0 : info.getColumn();
      String errorMessage = jexlEx.getMessage();
      if (errorMessage != null && (errorMessage.contains("unsolvable function/method")
          || errorMessage.contains("unsolvable property"))) {
        return new ELException(
            String.format("Security violation: Access to JEXL component '%s' is not "
                    + "permitted by wrangler. Hence, this JEXL expression '%s' can't be resolved.",
                detail, expression),
            jexlEx);
      }
      return new ELException(
          String.format("Error encountered while compiling '%s' at line '%d' "
              + "and column '%d'. Make sure a valid jexl "
              + "transformation is provided.",
              detail, line, column),
          jexlEx);
    }

wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java (189-191)

If allowlistEnabled is false, the sandbox should not be created or enforced at all. However, the current condition !allowlistEnabled && (inclusions == null || inclusions.isEmpty()) means that if allowlistEnabled is false but inclusions is not empty, a sandbox will still be created and enforced. This violates the feature flag and can break existing JEXL expressions in pipelines where the secure JEXL feature is disabled. Please simplify the check to return null immediately if allowlistEnabled is false.

    if (!allowlistEnabled) {
      return null;
    }

.vscode/settings.json (3-13)

Committing user-specific absolute paths (such as /usr/local/google/home/riyagarg/...) in shared configuration files is a bad practice. It will cause build or IDE configuration issues for other developers who do not have the same directory structure. Consider removing this file from the repository, adding .vscode/ to .gitignore, or using standard/relative paths.

wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java (215-217)

If inclusions contains a null element, iterating over it and calling applyInclusionRule will result in a NullPointerException when calling rule.getClassName(). Adding a null check for rule prevents this potential crash.

    if (rule == null || rule.getClassName() == null || rule.getClassName().trim().isEmpty()) {
      return;
    }

wrangler-api/src/main/java/io/cdap/wrangler/api/JexlInclusion.java (86-96)

If JexlInclusion is deserialized from JSON and the JSON explicitly contains "methods": null or "properties": null, the fields will be set to null (bypassing constructor defaults). Returning null from these getters can cause NullPointerExceptions downstream. Returning an empty list when they are null is much safer.

  public List<String> getMethods() {
    return methods == null ? Collections.emptyList() : methods;
  }

  /**
   * Gets the list of allowed properties.
   *
   * @return the allowed properties
   */
  public List<String> getProperties() {
    return properties == null ? Collections.emptyList() : properties;
  }

wrangler-api/src/main/java/io/cdap/wrangler/api/JexlInclusion.java (103-114)

If methods or properties is null due to deserialization, calling methods.isEmpty() or properties.isEmpty() will throw a NullPointerException. Adding null checks here ensures robust and defensive execution.

  public boolean isAllMethods() {
    return methods == null || methods.isEmpty() || methods.contains("*");
  }

  /**
   * Checks if all properties are allowed.
   *
   * @return true if all properties are allowed
   */
  public boolean isAllProperties() {
    return properties == null || properties.isEmpty() || properties.contains("*");
  }

[vsethi09]

When JSON string is deserialized to object, jexlAllowlist can get set to null.

In that case Collections.unmodifiableList(null) will throw NullPointerException.

Please handle this, if it is valid.

[vsethi09]

Please change to 2026 t/o for new .java files.

[vsethi09]

Add @NotNull annotation.

[vsethi09]

Can all the fields in this class be marked as final?

[vsethi09]

Simplify the code and remove unnecessary trim(). It is not useful as the string is already invalid.

See the previously suggested code.

Remove .trim() usage t/o.

[vsethi09]

Remove .trim() and simply use Strings.isNullOrEmpty()

Fix t/o

[riyaa14]

simply use Strings.isNullOrEmpty()

This is list of strings and isNullOrEmpty method is available for a individual strings, not for List

[vsethi09]

My bad this comment was meant for line: if (className == null || !isValidClassName(className.trim())) {

It can be changed to Strings.isNullOrEmpty(className)

[vsethi09]

Remove this check, if input is invalid throw exception.

Simplify code to remove this check below:

    if (sanitizedList.isEmpty()) {
      throw new IllegalArgumentException("The " + type + " list cannot be null or empty.");
    }

[vsethi09]

This should return immutable / unmodifiable list so that it cannot be mutated by getter.

[vsethi09]

(Optional suggestion) This EL class is doing more than expression language handling, i.e. creating JEXL engine and sanbox.

The logic for JEXL Engine and Sandbox creation can be moved to a separate class like JexlEngineFactory.create(...), which constructs engine with sandbox.

---

I understand this could be some change, so it can be done later and kept as it is for now.

[vsethi09]

throws IOException to be specific for the caller to handle?

[vsethi09]

Catch specific exception - IOException

--

Also no need to catch IOException and re-throw it.

[vsethi09]

Can be final if not modified instead this class?

[vsethi09]

IllegalArgumentException is not the correct exception as this function doesn't take any argument.

For simplicity you could do:

return jexlAllowlist == null ? List.of() : Collections.unmodifiableList(jexlAllowlist)

[riyaa14]

I think we shouldn't return empty string here.

Eg: When a user provided jexlAllowlist, but during JSON parsing, null returned, in this case if we don't return an error and rather pass an empty list, JexlSandbox will have no allowlisted classes and will block all, even though user provided an allowlist.

Whereas, if we throw an error, we easily understands the root cause.

[riyaa14]

Update: we are accepting null here, and throwing error later in DirectivesHandler for nulls.

[vsethi09]

Ideal way to handle this using GSON adapter for deserialization.

[riyaa14]

Implemented and tested

[vsethi09]

Use Collectors.toUnmodifiableList instead of wrapping.

[riyaa14]

Collectors doesn't have toUnmodifiableList, we'll need to do this:

Collectors.collectingAndThen(Collectors.toList(), Collections::unmodifiableList
or
wrap with unmodifiable list as done currently.

wrapping with unmodifiable list seems more readable.

[vsethi09]

Use String.isNullOrEmpty()

Fix t/o

[vsethi09]

nit: Move this comment to wrangler-storage/src/main/java/io/cdap/wrangler/dataset/workspace/ConfigStore.java

The callers will never know about this behavior if the comment is mentioned here.

[vsethi09]

why is this public?

[vsethi09]

Use unmodifiable / immutable.

[vsethi09]

Why is this needed?

(Throwable) null

[vsethi09]

Why is this needed?

(Throwable) null