From d7595646944904f11ce6ca4cf8cc5452c965c239 Mon Sep 17 00:00:00 2001
From: Riya Garg <riyagarg@google.com>
Date: Wed, 3 Jun 2026 11:24:54 +0000
Subject: [PATCH 1/2] upgrade jexl version to 3.3

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 4929993c5..a17664541 100644
--- a/pom.xml
+++ b/pom.xml
@@ -77,7 +77,7 @@
     <commons.validator.version>1.6</commons.validator.version>
     <commons-io.version>2.16.1</commons-io.version>
     <commons-csv.version>1.4</commons-csv.version>
-    <commons-jexl.version>3.0</commons-jexl.version>
+    <commons-jexl.version>3.3</commons-jexl.version>
     <commons-lang.version>2.6</commons-lang.version>
     <commons-lang3.version>3.5</commons-lang3.version>
     <commons-math3.version>3.6.1</commons-math3.version>

From 45b633b87bb3979d5f25259cf8c5ce082e9b34b4 Mon Sep 17 00:00:00 2001
From: Riya Garg <riyagarg@google.com>
Date: Wed, 3 Jun 2026 12:56:12 +0000
Subject: [PATCH 2/2] update jexl parser logic and expression permission

---
 .../src/main/java/io/cdap/wrangler/expression/EL.java  |  2 ++
 .../cdap/wrangler/metrics/JexlCategoryMetricUtils.java |  5 ++---
 .../io/cdap/directives/row/RowConditionFilterTest.java | 10 ++++++----
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java b/wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java
index 28baad940..d3f3cac09 100644
--- a/wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java
+++ b/wrangler-core/src/main/java/io/cdap/wrangler/expression/EL.java
@@ -35,6 +35,7 @@
 import org.apache.commons.jexl3.JexlException;
 import org.apache.commons.jexl3.JexlInfo;
 import org.apache.commons.jexl3.JexlScript;
+import org.apache.commons.jexl3.introspection.JexlPermissions;
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.logging.Log;
@@ -87,6 +88,7 @@ public static EL compile(ELRegistration registration, String expression) throws
       .cache(1024)
       .strict(true)
       .logger(new NullLogger())
+      .permissions(JexlPermissions.UNRESTRICTED)
       .create();
 
     try {
diff --git a/wrangler-core/src/main/java/io/cdap/wrangler/metrics/JexlCategoryMetricUtils.java b/wrangler-core/src/main/java/io/cdap/wrangler/metrics/JexlCategoryMetricUtils.java
index ffc0225b2..a762ad998 100644
--- a/wrangler-core/src/main/java/io/cdap/wrangler/metrics/JexlCategoryMetricUtils.java
+++ b/wrangler-core/src/main/java/io/cdap/wrangler/metrics/JexlCategoryMetricUtils.java
@@ -20,8 +20,7 @@
 import io.cdap.wrangler.expression.EL;
 import org.apache.commons.jexl3.parser.ParserTokenManager;
 import org.apache.commons.jexl3.parser.SimpleCharStream;
-
-import java.io.ByteArrayInputStream;
+import org.apache.commons.jexl3.parser.StringProvider;
 import java.util.Map;
 
 import javax.annotation.Nullable;
@@ -57,7 +56,7 @@ public static EntityCountMetric getJexlCategoryMetric(String jexlScript) {
 
   private static String parseJexlCategory(String script) {
     ParserTokenManager manager = new ParserTokenManager(
-      new SimpleCharStream(new ByteArrayInputStream(script.getBytes())));
+      new SimpleCharStream(new StringProvider(script)));
     return manager.getNextToken().toString();
   }
 }
diff --git a/wrangler-core/src/test/java/io/cdap/directives/row/RowConditionFilterTest.java b/wrangler-core/src/test/java/io/cdap/directives/row/RowConditionFilterTest.java
index 18e3c108f..12e14cc45 100644
--- a/wrangler-core/src/test/java/io/cdap/directives/row/RowConditionFilterTest.java
+++ b/wrangler-core/src/test/java/io/cdap/directives/row/RowConditionFilterTest.java
@@ -19,6 +19,8 @@
 import io.cdap.wrangler.TestingRig;
 import io.cdap.wrangler.api.RecipeException;
 import io.cdap.wrangler.api.Row;
+import io.cdap.wrangler.expression.EL;
+import io.cdap.wrangler.expression.ELContext;
 import org.junit.Assert;
 import org.junit.Test;
 
@@ -30,17 +32,17 @@
  */
 public class RowConditionFilterTest {
 
-  @Test(expected = RecipeException.class)
-  public void testRHSLHSTypeDisconnect() throws Exception {
+  @Test
+  public void testRHSLHSTypeCoercion() throws Exception {
     String[] directives = new String[]{
       "parse-as-csv body ,",
       "drop body",
       "set columns PassengerId,Survived,Pclass,Name,Sex,Age,SibSp,Parch,Ticket,Fare,Cabin,Embarked",
-      "filter-row-if-true Fare < 10" // RHS is double, but it's not converted. Check next test case.
+      "filter-row-if-true Fare < 10" // JEXL 3.3 supports coercion between string and numeric types directly
     };
 
     List<Row> rows = Arrays.asList(
-      new Row("body", "1,0,3,\"Braund, Mr. Owen Harris\",male,22,1,0,A/5 21171,7.25,,S"),
+      new Row("body", "1,0,3,\"Braund, Mr. Owen Harris\",male,22,1,0,A/5 21171,7,,S"),
       new Row("body", "2,1,1,\"Cumings, Mrs. John Bradley (Florence Briggs Thayer)\",female," +
         "38,1,0,PC 17599,71.2833,C85,C")
     );