Add access control for NashornJS and GraalJS

modules/core/src/main/java/org/apache/synapse/ServerManager.java

@@ -18,8 +18,14 @@
  */
 package org.apache.synapse;
 
+import java.util.Arrays;
+import java.util.Properties;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.apache.synapse.script.access.AccessControlConfig;
+import org.apache.synapse.script.access.AccessControlConstants;
+import org.apache.synapse.script.access.AccessControlListType;
+import org.apache.synapse.script.access.ScriptAccessControl;
 import org.apache.synapse.aspects.flow.statistics.collectors.RuntimeStatisticCollector;
 import org.apache.synapse.aspects.flow.statistics.tracing.opentelemetry.OpenTelemetryManagerHolder;
 import org.apache.synapse.commons.jmx.MBeanRegistrar;
@@ -31,6 +37,7 @@
 
 import java.util.Date;
 import javax.management.NotCompliantMBeanException;
+import static org.apache.synapse.script.access.AccessControlConstants.ENABLE;
 
 /**
  * This is the core class that starts up a Synapse instance.
@@ -407,8 +414,10 @@ private void doInit() {
             registerMBean();
 
             // initialize global PasswordManager instance used in synapse
-            PasswordManager.getInstance().init(
-                    SynapsePropertiesLoader.loadSynapseProperties(), SynapseConstants.SYNAPSE);
+            Properties properties = SynapsePropertiesLoader.loadSynapseProperties();
+            PasswordManager.getInstance().init(properties, SynapseConstants.SYNAPSE);
+
+            readAndSetScriptAccessControl(properties);
 
             // initializes the SynapseController
             this.synapseController.init(serverConfigurationInformation, serverContextInformation);
@@ -421,6 +430,49 @@ private void doInit() {
         }
     }
 
+    /**
+     * Reads and sets access control configurations.
+     *
+     * @param properties Synapse properties.
+     */
+    private void readAndSetScriptAccessControl(Properties properties) {
+        String limitClassAccessEnabled = properties.getProperty(
+                AccessControlConstants.LIMIT_CLASS_ACCESS_PREFIX + AccessControlConstants.ENABLE);
+        if (Boolean.parseBoolean(limitClassAccessEnabled)) {
+            String limitClassAccessListType =
+                    properties.getProperty(
+                            AccessControlConstants.LIMIT_CLASS_ACCESS_PREFIX + AccessControlConstants.LIST_TYPE);
+            String limitClassAccessClassPrefixes = properties.getProperty(
+                    AccessControlConstants.LIMIT_CLASS_ACCESS_PREFIX + AccessControlConstants.CLASS_PREFIXES);
+            ScriptAccessControl.getInstance().setClassAccessControlConfig(
+                    new AccessControlConfig(true, AccessControlListType.valueOf(limitClassAccessListType),
+                            Arrays.asList(limitClassAccessClassPrefixes.split(","))));
+        }
+
+        String limitNativeObjectAccessEnabled = properties.getProperty(
+                AccessControlConstants.LIMIT_NATIVE_OBJECT_ACCESS_PREFIX + ENABLE);
+        if (Boolean.parseBoolean(limitNativeObjectAccessEnabled)) {
+            String limitNativeObjectAccessListType =
+                    properties.getProperty(AccessControlConstants.LIMIT_NATIVE_OBJECT_ACCESS_PREFIX +
+                            AccessControlConstants.LIST_TYPE);
+            String limitNativeObjectAccessClassPrefixes =
+                    properties.getProperty(AccessControlConstants.LIMIT_NATIVE_OBJECT_ACCESS_PREFIX +
+                            AccessControlConstants.OBJECT_NAMES);
+            ScriptAccessControl.getInstance().setNativeObjectAccessControlConfig(
+                    new AccessControlConfig(true, AccessControlListType.valueOf(limitNativeObjectAccessListType),
+                            Arrays.asList(limitNativeObjectAccessClassPrefixes.split(","))));
+        }
+        if (!Boolean.parseBoolean(limitClassAccessEnabled) && !Boolean.parseBoolean(limitNativeObjectAccessEnabled)) {
+            log.warn("\n##################################  ALERT  ##################################\n" +
+                    "[WARNING]: Default configuration is used for the script mediator which might expose the " +
+                    "environment to potential security risks. Please ensure that the required configuration changes " +
+                    "are applied in accordance with the \"Configuring Script Mediator\" section of the \"Security " +
+                    "Guidelines for Production Deployment\"\n" +
+                    "#############################################################################");
+        }
+    }
+
+
     /**
      * Helper method to shutdown the the ServerManager
      */

modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/access/control/config/AccessControlConfig.java → modules/core/src/main/java/org/apache/synapse/script/access/AccessControlConfig.java

@@ -16,7 +16,7 @@
  * under the License.
  */
 
-package org.apache.synapse.mediators.bsf.access.control.config;
+package org.apache.synapse.script.access;
 
 import java.util.List;
 

modules/core/src/main/java/org/apache/synapse/script/access/AccessControlConstants.java

@@ -0,0 +1,10 @@
+package org.apache.synapse.script.access;
+
+public class AccessControlConstants {
+    public static String LIMIT_CLASS_ACCESS_PREFIX = "limit_java_class_access_in_scripts.";
+    public static String LIMIT_NATIVE_OBJECT_ACCESS_PREFIX = "limit_java_native_object_access_in_scripts.";
+    public static String ENABLE = "enable";
+    public static String LIST_TYPE = "list_type";
+    public static String CLASS_PREFIXES = "class_prefixes";
+    public static String OBJECT_NAMES = "object_names";
+}

modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/access/control/config/AccessControlListType.java → modules/core/src/main/java/org/apache/synapse/script/access/AccessControlListType.java

@@ -15,18 +15,14 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
-package org.apache.synapse.mediators.bsf.access.control.config;
+package org.apache.synapse.script.access;
 
 /**
-
  * Represents the type of access control list for the Script Mediator.
-
  */
 
 public enum AccessControlListType {
-    ALLOW_LIST,
-    BLOCK_LIST
+    ALLOW_LIST, BLOCK_LIST
 
 }
 

modules/core/src/main/java/org/apache/synapse/script/access/ScriptAccessControl.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.synapse.script.access;
+
+/**
+ * Singleton class to hold the access control configurations of the Script Mediator.
+ */
+public class ScriptAccessControl {
+    private static final ScriptAccessControl instance = new ScriptAccessControl();
+
+    private AccessControlConfig classAccessControlConfig;
+    private AccessControlConfig nativeObjectAccessControlConfig;
+
+    private ScriptAccessControl() {
+    }
+
+    public static ScriptAccessControl getInstance() {
+        return instance;
+    }
+
+    public AccessControlConfig getClassAccessControlConfig() {
+        return classAccessControlConfig;
+    }
+
+    public void setClassAccessControlConfig(AccessControlConfig classAccessControlConfig) {
+        this.classAccessControlConfig = classAccessControlConfig;
+    }
+
+    public AccessControlConfig getNativeObjectAccessControlConfig() {
+        return nativeObjectAccessControlConfig;
+    }
+
+    public void setNativeObjectAccessControlConfig(AccessControlConfig nativeObjectAccessControlConfig) {
+        this.nativeObjectAccessControlConfig = nativeObjectAccessControlConfig;
+    }
+}