Index: lucene/expressions/src/java/org/apache/lucene/expressions/js/JavascriptCompiler.java
===================================================================
--- lucene/expressions/src/java/org/apache/lucene/expressions/js/JavascriptCompiler.java	(revision 1677928)
+++ lucene/expressions/src/java/org/apache/lucene/expressions/js/JavascriptCompiler.java	(working copy)
@@ -23,6 +23,7 @@
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.nio.charset.StandardCharsets;
+import java.security.ProtectionDomain;
 import java.text.ParseException;
 import java.util.Arrays;
 import java.util.Collections;
@@ -79,8 +80,8 @@
       super(parent);
     }

-    public Class<? extends Expression> define(String className, byte[] bytecode) {
-      return defineClass(className, bytecode, 0, bytecode.length).asSubclass(Expression.class);
+    public Class<? extends Expression> define(String className, byte[] bytecode, ProtectionDomain domain) {
+      return defineClass(className, bytecode, 0, bytecode.length, domain).asSubclass(Expression.class);
     }
   }

@@ -123,10 +124,22 @@
    * @throws ParseException on failure to compile
    */
   public static Expression compile(String sourceText) throws ParseException {
-    return new JavascriptCompiler(sourceText).compileExpression(JavascriptCompiler.class.getClassLoader());
+    return compile(sourceText, null);
   }

   /**
+   * Compiles the given expression.
+   *
+   * @param sourceText The expression to compile
+   * @param domain an optional {@code ProtectionDomain} for the loaded class.
+   * @return A new compiled expression
+   * @throws ParseException on failure to compile
+   */
+  public static Expression compile(String sourceText, ProtectionDomain domain) throws ParseException {
+    return new JavascriptCompiler(sourceText).compileExpression(JavascriptCompiler.class.getClassLoader(), domain);
+  }
+
+  /**
    * Compiles the given expression with the supplied custom functions.
    * <p>
    * Functions must be {@code public static}, return {@code double} and
@@ -140,6 +153,24 @@
    * @throws ParseException on failure to compile
    */
   public static Expression compile(String sourceText, Map<String,Method> functions, ClassLoader parent) throws ParseException {
+    return compile(sourceText, functions, parent, null);
+  }
+
+  /**
+   * Compiles the given expression with the supplied custom functions.
+   * <p>
+   * Functions must be {@code public static}, return {@code double} and
+   * can take from zero to 256 {@code double} parameters.
+   *
+   * @param sourceText The expression to compile
+   * @param functions map of String names to functions
+   * @param parent a {@code ClassLoader} that should be used as the parent of the loaded class.
+   *   It must contain all classes referred to by the given {@code functions}.
+   * @param domain an optional {@code ProtectionDomain} for the loaded class.
+   * @return A new compiled expression
+   * @throws ParseException on failure to compile
+   */
+  public static Expression compile(String sourceText, Map<String,Method> functions, ClassLoader parent, ProtectionDomain domain) throws ParseException {
     if (parent == null) {
       throw new NullPointerException("A parent ClassLoader must be given.");
     }
@@ -146,7 +177,7 @@
     for (Method m : functions.values()) {
       checkFunction(m, parent);
     }
-    return new JavascriptCompiler(sourceText, functions).compileExpression(parent);
+    return new JavascriptCompiler(sourceText, functions).compileExpression(parent, domain);
   }

   /**
@@ -181,12 +212,12 @@
   }

   /**
-   * Compiles the given expression with the specified parent classloader
+   * Compiles the given expression with the specified parent classloader and domain.
    *
    * @return A new compiled expression
    * @throws ParseException on failure to compile
    */
-  private Expression compileExpression(ClassLoader parent) throws ParseException {
+  private Expression compileExpression(ClassLoader parent, ProtectionDomain domain) throws ParseException {
     try {
       Tree antlrTree = getAntlrComputedExpressionTree();

@@ -195,7 +226,7 @@
       endCompile();

       Class<? extends Expression> evaluatorClass = new Loader(parent)
-        .define(COMPILED_EXPRESSION_CLASS, classWriter.toByteArray());
+        .define(COMPILED_EXPRESSION_CLASS, classWriter.toByteArray(), domain);
       Constructor<? extends Expression> constructor = evaluatorClass.getConstructor(String.class, String[].class);
       return constructor.newInstance(sourceText, externalsMap.keySet().toArray(new String[externalsMap.size()]));
     } catch (InstantiationException | IllegalAccessException | NoSuchMethodException | InvocationTargetException exception) {
Index: lucene/expressions/src/test/org/apache/lucene/expressions/js/TestJavascriptCompiler.java
===================================================================
--- lucene/expressions/src/test/org/apache/lucene/expressions/js/TestJavascriptCompiler.java	(revision 1677928)
+++ lucene/expressions/src/test/org/apache/lucene/expressions/js/TestJavascriptCompiler.java	(working copy)
@@ -16,6 +16,10 @@
  * limitations under the License.
  */

+import java.net.URL;
+import java.security.CodeSigner;
+import java.security.CodeSource;
+import java.security.ProtectionDomain;
 import java.text.ParseException;

 import org.apache.lucene.expressions.Expression;
@@ -209,4 +213,10 @@
     x = JavascriptCompiler.compile("foo['\\\\'][\"\\\\\"]");
     assertEquals("foo['\\\\']['\\\\']", x.variables[0]);
   }
+
+  public void testProtectionDomain() throws Exception {
+    ProtectionDomain fake = new ProtectionDomain(new CodeSource(new URL("file:/bogus"), (CodeSigner[])null), null);
+    Expression x = JavascriptCompiler.compile("foo + bar", fake);
+    assertSame(fake, x.getClass().getProtectionDomain());
+  }
 }
Index: lucene/tools/junit4/tests.policy
===================================================================
--- lucene/tools/junit4/tests.policy	(revision 1677928)
+++ lucene/tools/junit4/tests.policy	(working copy)
@@ -71,6 +71,8 @@
   permission java.lang.RuntimePermission "createClassLoader";
   // expressions TestCustomFunctions (only on older java8?)
   permission java.lang.RuntimePermission "getClassLoader";
+  // expressions TestJavaScriptCompiler
+  permission java.lang.RuntimePermission "getProtectionDomain";
   // needed to test unmap hack on platforms that support it
   permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
   // needed by jacoco to dump coverage