我可以在java中使用来自服务器回调的javascript函数吗？

Question

I am making some java project about non-using browser service.

So, I want to use some JavaScript function from server (which is a callback from my POST)

I saw many codes about using JavaScript in java, but it's from local files.

I think one solution about this:

When callback is coming, save this code and use it again. But I think it's not optimal for our project.

Can you give me any other solution?

Thank you in advance.

Answer 1

Yes, you can, as @Daniel Baranowski suggested above.
And no, you absolutely shouldn't.
Running any code submitted by the client is putting yourself in an extreme risk.
Can it access your filesystem? Then you're in trouble.
Can it execute network calls? Then you're also in trouble.
And even if you blocked those options, do you check that this user code terminates in time?

Answer 2

It is certainly possible but it can expose you to huge security risks .

Nothing is stopping you from running JavaScript code directly from a String. Having it saved in a file is not a requirement. You can get the body of the POST which was send do your server and execute it somewhat like this:

 package example;

        import jdk.nashorn.api.scripting.JSObject;
        import jdk.nashorn.api.scripting.NashornScriptEngine;    
        import javax.script.ScriptEngineManager;
        import javax.script.ScriptException;

        public class Example {
            private final ThreadLocal<NashornScriptEngine> engineHolder;

            public Example() {
                // You don't need to run code from files. The code can be a string which was posted to your server.
                String jsCodeToRun = "function helloWorld(name) { return { value: 'Hello' + name } }"

                this.engineHolder = ThreadLocal.withInitial(() -> {
                    NashornScriptEngine nashornScriptEngine = (NashornScriptEngine) new ScriptEngineManager().getEngineByName("nashorn");
                    try {
                        nashornScriptEngine.eval(jsCodeToRun);
                    } catch (ScriptException e) {
                        throw new RuntimeException(e);
                    }
                    return nashornScriptEngine;
                });
            }

           public JSObject runTheCode(String name) {
              try {
                JSObject result = (JSObject) engineHolder.get().invokeFunction("helloWorld", name);

                // The result will be an object returned by our helloWorld function.
                return result;
            } catch (Exception e) {
                throw new IllegalStateException(e);
            }
        }
        }