xicmiah / see Goto Github PK

Evaluation of function literals fails, if one of arguments is null.

function(a) { a; } (null)

Lets assume we have a class A with method doSomething(int value). Now we can't invoke this method in see script

a = 1; //BigDecimal by default now
bean.doSomething(1.intValue());//fails as no such method exception

The problem is that see wraps any value explicitly with NumberFactory. If number factory produce BigDecimals, it's unable to get an int value, even with explicit call to Number#intValue()

Example

a = 1;
fileClass = a.class.forName("java.io.File");//works!!!

Complete object creation is difficult because of every number by default is wrapped by number factory (to BigDecimal now), but some reflection feature can still be invoked.
It'l be better to deny class property usage or "forName" method, to block java reflection usage

Evaluation of this script throws an exception:
map = {};
map["a.b"];