Enable class lookup in Graaljs

[tokou]

Proposed changes

• I wanted to try and revert the GraalJS version but keep the other changes that seem to be already compatible with the older version
• These changes allow for users to load platform (i.e. Java) classes into JS like in the example
• This seems to satisfy the request in the opened issue

Testing

• All tests run fine locally. Let's see on the CI

Issues fixed

Linked #1949
Fixes #1388

[bartekpacia]

Hey again Tarek, thank you for this PR :)

Overall I love it, but I'm afraid there are some security concerns related to how this feature would affect Maestro Cloud (I'm double checking this with our backend guys and will get back).

Merging this as-is would allow for arbitrary code execution on Maestro Cloud's macOS machines (i.e. break the sandbox). Someone could write in their Maestro JS file var File = Java.type('java.io.File'), (or call Runtime.getRuntime() and then rm -rf or similar) and do nasty things.

[tokou]

Yeah I understand the security risk @bartekpacia
It's something we should consider
We can maybe make this option configurable through an env var or something?

[bartekpacia]

Yes, let's guard this new functionality with env vars:

Host access

allowHostAccess(HostAccess.ALL)

Call only when MAESTRO_CLI_DANGEROUS_GRAALJS_ALLOW_HOST_ACCESS is set (to any value, e.g. 1 or true).

Host

allowHostClassLookup { true }

Call only when MAESTRO_CLI_DANGEROUS_GRAALJS_ALLOW_HOST_CLASS_LOOKUP is set (to any value, e.g. 1 or true).

Why the DANGEROUS in the name?

We need to make sure the user won't just set this env var with maestro cloud --env and bypass this whole security mechanism.

So we will ignore all env vars starting with MAESTRO_CLI_DANGEROUS on Maestro Cloud.

Docs

Let's also add docs and make it very clear that:

1. It's an experimental feature (just like Maestro webdriver)
2. It's not under active development, but if submit a PR, we are happy to review it

---

How does it all sound to you? :)

[bartekpacia]

@tokou fyi I'm happy to merge this feature (assuming it'll be guarded with the env vars, as described above)