[riyaa14]

Summary

Update the JEXL allowlist configuration to support constructor permissions and include standard EL function classes by default.

Changes

• Default Allowlist: Added commonly used default EL function classes (io.cdap.functions.*, StringUtils, Strings, StringEscapeUtils, etc.) to DefaultJexlAllowlist.
• Constructor Support: Updated JexlAllowlist validation to allow empty strings ("") in the methods list, which JEXL uses to represent class constructors.

[gemini-code-assist]

Code Review

This pull request adds commonly used EL functions to the default JEXL allowlist, updates the sanitization logic in JexlAllowlist to permit empty strings in methods, and introduces comprehensive deserialization unit tests. The review feedback correctly points out that several standard EL function classes (such as Global, GeoFences, and Bytes) are missing from the default allowlist, which would cause expressions using them to fail, and provides a code suggestion to include them.

[gemini-code-assist]

Several standard EL function classes registered in EL.DefaultFunctions are missing from the default JEXL allowlist:

• io.cdap.functions.Global (used for global namespace functions like coalesce, typeof, etc.)
• io.cdap.functions.GeoFences (used for geo namespace functions)
• io.cdap.cdap.api.common.Bytes (used for bytes namespace functions)

Without adding these to the default allowlist, standard EL expressions using these functions will fail when the JEXL allowlist is enabled.

Suggested change

	"io.cdap.functions.DateAndTime", "io.cdap.functions.Dates",
	"io.cdap.functions.JsonFunctions", "io.cdap.wrangler.utils.DecimalTransform",
	"io.cdap.wrangler.utils.ArithmeticOperations", "org.apache.commons.lang.StringUtils",
	"com.google.common.base.Strings", "org.apache.commons.lang3.StringEscapeUtils",
	"io.cdap.functions.DataQuality", "io.cdap.functions.DDL", "io.cdap.functions.Logical",
	"io.cdap.functions.NumberFunctions");
	"io.cdap.functions.DateAndTime", "io.cdap.functions.Dates",
	"io.cdap.functions.JsonFunctions", "io.cdap.wrangler.utils.DecimalTransform",
	"io.cdap.wrangler.utils.ArithmeticOperations", "org.apache.commons.lang.StringUtils",
	"com.google.common.base.Strings", "org.apache.commons.lang3.StringEscapeUtils",
	"io.cdap.functions.DataQuality", "io.cdap.functions.DDL", "io.cdap.functions.Logical",
	"io.cdap.functions.NumberFunctions", "io.cdap.functions.Global", "io.cdap.functions.GeoFences",
	"io.cdap.cdap.api.common.Bytes");