Restrict polyglot host access

Signed-off-by: Andre Kurait <[email protected]>
opensearch-project · Jan 11, 2025 · a1c3a6a · a1c3a6a
1 parent bc6e289
commit a1c3a6a
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/...ers/jsonJSTransformer/src/main/java/org/opensearch/migrations/transform/ScriptRunner.java b/...ers/jsonJSTransformer/src/main/java/org/opensearch/migrations/transform/ScriptRunner.java
@@ -7,6 +7,7 @@
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 import org.graalvm.polyglot.Context;
+import org.graalvm.polyglot.HostAccess;
 import org.graalvm.polyglot.Value;
 import org.graalvm.polyglot.proxy.ProxyArray;
 import org.graalvm.polyglot.proxy.ProxyExecutable;
@@ -18,7 +19,14 @@ public class ScriptRunner {
 
     public ScriptRunner() {
         this.context = Context.newBuilder("js")
-            .allowAllAccess(true)
+            .allowHostAccess(HostAccess.newBuilder()
+                .allowArrayAccess(true)
+                .allowMapAccess(true)
+                .allowListAccess(true)
+                .allowIterableAccess(true)
+                .allowAccessInheritance(true)
+                .allowBufferAccess(true)
+                .build())
             .build();
     }