001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 */
017package org.apache.juneau.commons.template;
018
019import java.util.*;
020
021/**
022 * The default function allowlist of a {@link TemplateResolver}.
023 *
024 * <p>
025 * Pure, bounded string and collection helpers, the structure functions and the operators.  Deliberately left out:
026 * <ul>
027 *    <li>Functions that read arbitrary data (<c>jsonPath</c>, <c>get</c>, <c>extract</c>, <c>keys</c>, <c>values</c>).
028 *    <li>Regex functions (<c>match</c>, <c>replaceRegex</c>), which can backtrack catastrophically on author-chosen patterns.
029 *    <li>Non-deterministic functions (<c>rand*</c>, <c>uuid</c>, <c>now</c>) and date parsing.
030 *    <li>Functions that can allocate large results from small input (<c>repeat</c>) or that reach the platform
031 *       (<c>switch</c>, the encoding functions).
032 * </ul>
033 * {@link TemplateResolver.Builder#allowFunctions(String...)} replaces this list.
034 */
035public final class SafeFunctions {
036
037   private static final List<String> PATTERNS = List.of(
038      "upper", "lower", "trim", "len", "size", "substring", "split", "join", "concat", "replace",
039      "startsWith", "endsWith", "contains", "if", "coalesce", "notEmpty",
040      "ul", "ol", "block", "table", "list", "take",
041      "$op.*"
042   );
043
044   private SafeFunctions() {}
045
046   /**
047    * Returns the default allowlist patterns.
048    *
049    * @return An unmodifiable list of glob patterns, as accepted by
050    *    {@link org.apache.juneau.commons.svl.VarResolver.Builder#allowFunctions(String...)}.
051    */
052   public static List<String> patterns() { return PATTERNS; }
053}