Reputation: 10964

Execute script in Java program at runtime

I encounter this issue when calculating the price for a product but the formula changes nearly every day because of marketing schemes, discounts, taxes...

So I think it would be great if I could write code such as the code below, so that I could change the script at runtime.

public BigDecimal calculate(String script) {
   return (BigDecimal) ScriptEngine.execute(script);
}

Is there any way to implement this using Java?

Upvotes: 1

Answers (4)

Aaron Digulla

Reputation: 328830

Yes: Use the Scripting API.

There are implementations to run scripts written in JavaScript, Groovy, Python and lots of other languages.

[EDIT]

Since it was mentioned in the comments: Be wary of security issues.

There are several options:

You allow end-customers to supply scripts (say in a web form)
You don't allow customers to supply scripts; if a script needs to be changes an administrator or developer must start a specific tool.
You develop a system which only allows to execute "safe" scripts

Option #3 doesn't work (= only works for the most simple cases). There is a mathematical proof that a computer program can never tell what another program can potentially do without actually executing it.

So you can get away with option #3 if you don't allow to call methods (or only a very, very limited set of methods). But most scripting languages allow to access Java classes which means you can eventually get System.exit() or Runtime.exec(). This in turn means you have to write a parser which makes sure that the code doesn't contain something odd.

Which you will have to update every day because the customers will come up with new ... err ... interesting ways to use the feature.

Also chances are that you'll make a mistake - either the parser won't accept valid input or it will let malicious code pass. Given the complexity of the problem, the chance is between 99.9999% and 100%.

Option #1 means no security at all but after the third change, customers will berate you to adopt it. It will work for some time until the first script kiddie comes along and ruins everything. Guess whose fault that will be? The manager who hired ~~his nephew~~... the kid?

So a human will have to eyeball the scripts, fix all the bugs in them and configure the system to run them. Option #2 will cause all kinds of griefs, too, but it will cause less grief, all things considered.

Upvotes: 3