From df88e5b4f9f0a42e4ddcebd3863c194b58647383 Mon Sep 17 00:00:00 2001
From: "Luis C.M" <42545778+c0508383@users.noreply.github.com>
Date: Tue, 27 Feb 2024 21:18:53 -0600
Subject: [PATCH] Implemented banned classes config for Nashorn scripts.

---
 .../java/noppes/npcs/config/ConfigScript.java | 15 +++++++++++++
 .../npcs/controllers/ScriptController.java    | 21 +++++++++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/src/main/java/noppes/npcs/config/ConfigScript.java b/src/main/java/noppes/npcs/config/ConfigScript.java
index 3dcc5f4a2..655a55635 100644
--- a/src/main/java/noppes/npcs/config/ConfigScript.java
+++ b/src/main/java/noppes/npcs/config/ConfigScript.java
@@ -11,6 +11,8 @@ import noppes.npcs.config.legacy.LegacyConfig;
 import org.apache.logging.log4j.Level;
 
 import java.io.File;
+import java.util.Arrays;
+import java.util.HashSet;
 import java.util.UUID;
 
 public class ConfigScript
@@ -50,6 +52,9 @@ public class ConfigScript
     public static Property ScriptDevIDsProperty;
     public static String ScriptDevIDs = "";
 
+    public static Property BannedClassesProperty;
+    public final static HashSet<String> BannedClasses = new HashSet<>();
+
     public static void init(File configFile)
     {
         config = new Configuration(configFile);
@@ -133,6 +138,16 @@ public class ConfigScript
                 }
             } catch (Exception ignored) {}
 
+            BannedClassesProperty = config.get(CUSTOMIZATION, "Banned Classes", "java.net.URL,java.net.URI",
+                "Comma separated list of classes that cannot be used in scripts through Java.for().\n" +
+                    "Classes must be fully written out with library names preceding them.\n" +
+                    "This is a feature ONLY AVAILABLE ON NASHORN.");
+            String bannedClassesString = BannedClassesProperty.getString();
+
+            try {
+                BannedClasses.clear();
+                BannedClasses.addAll(Arrays.asList(bannedClassesString.split(",")));
+            } catch (Exception ignored) {}
         }
         catch (Exception e)
         {
diff --git a/src/main/java/noppes/npcs/controllers/ScriptController.java b/src/main/java/noppes/npcs/controllers/ScriptController.java
index bcd1c66d2..ddd75ab9a 100644
--- a/src/main/java/noppes/npcs/controllers/ScriptController.java
+++ b/src/main/java/noppes/npcs/controllers/ScriptController.java
@@ -1,6 +1,8 @@
 package noppes.npcs.controllers;
 
 import cpw.mods.fml.common.eventhandler.SubscribeEvent;
+import jdk.nashorn.api.scripting.ClassFilter;
+import jdk.nashorn.api.scripting.NashornScriptEngineFactory;
 import net.minecraft.entity.player.EntityPlayer;
 import net.minecraft.nbt.NBTTagCompound;
 import net.minecraft.nbt.NBTTagList;
@@ -248,7 +250,22 @@ public class ScriptController {
 	private static final List<String> nashornNames = immutableList("nashorn", "Nashorn", "js", "JS", "JavaScript", "javascript", "ECMAScript", "ecmascript");
 	public ScriptEngine getEngineByName(String language) {
 		if (nashornNames.contains(language) && this.nashornFactory != null) {
-			ScriptEngine scriptEngine = this.nashornFactory.getScriptEngine();
+            ScriptEngine scriptEngine;
+
+            try {
+                ClassFilter filter = s -> {
+                    for (String className : ConfigScript.BannedClasses) {
+                        if (s.compareTo(className) == 0) {
+                            return false;
+                        }
+                    }
+                    return true;
+                };
+                NashornScriptEngineFactory nashornScriptEngineFactory = (NashornScriptEngineFactory) this.nashornFactory;
+                scriptEngine = nashornScriptEngineFactory.getScriptEngine(filter);
+            } catch (Exception e) {
+                scriptEngine = this.nashornFactory.getScriptEngine();
+            }
 			scriptEngine.setBindings(this.manager.getBindings(), ScriptContext.GLOBAL_SCOPE);
 			return scriptEngine;
 		}
@@ -300,4 +317,4 @@ public class ScriptController {
 
 		shouldSave = false;
 	}
-}
\ No newline at end of file
+}