Groovy
  1. Groovy
  2. GROOVY-4978

SecureASTCustomizer blacklist is ignored inside method body

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 1.8.1
    • Fix Version/s: 1.8.2, 1.9-beta-3
    • Component/s: Compiler
    • Labels:
      None

      Description

      I'm trying to compile Groovy Scripts while rejecting calls to System.exit() by using using a SecureASTCustomizer like this:

      final SecureASTCustomizer customizer = new SecureASTCustomizer();
      customizer.setImportsBlacklist(asList("java.lang.System",
      		"groovy.lang.GroovyShell", "groovy.lang.GroovyClassLoader"));
      customizer.setIndirectImportCheckEnabled(true);
      
      CompilerConfiguration configuration = new CompilerConfiguration();
      configuration.addCompilationCustomizers(customizer);
      
      ClassLoader parent = ScriptCompiler.class.getClassLoader();
      GroovyClassLoader loader = new GroovyClassLoader(parent, configuration);
      

      The following Script is blocked correctly and I get an exception during parseClass()

      System.exit(1);
      

      In the following script, System.exit() is called successfully:

      def x() { System.exit(1) }
      x()
      

        Activity

        Carsten Mjartan created issue -
        Hide
        Carsten Mjartan added a comment -

        Failing JUnit4 Test Case

        Show
        Carsten Mjartan added a comment - Failing JUnit4 Test Case
        Carsten Mjartan made changes -
        Field Original Value New Value
        Attachment SecureScriptTest.java [ 56435 ]
        Guillaume Delcroix made changes -
        Assignee Cedric Champeau [ melix ]
        Cédric Champeau made changes -
        Status Open [ 1 ] In Progress [ 3 ]
        Hide
        Cédric Champeau added a comment -

        I fixed this issue, but there are still problems regarding constructors because the AST transformation can't determine whether the constructor was handwritten or generated by the groovy compiler.

        Show
        Cédric Champeau added a comment - I fixed this issue, but there are still problems regarding constructors because the AST transformation can't determine whether the constructor was handwritten or generated by the groovy compiler.
        Cédric Champeau made changes -
        Fix Version/s 1.9-beta-2 [ 17494 ]
        Resolution Fixed [ 1 ]
        Status In Progress [ 3 ] Resolved [ 5 ]
        Fix Version/s 1.8.2 [ 17495 ]
        Paul King made changes -
        Status Resolved [ 5 ] Closed [ 6 ]
        Mark Thomas made changes -
        Project Import Sun Apr 05 13:32:57 UTC 2015 [ 1428240777691 ]
        Mark Thomas made changes -
        Workflow jira [ 12733904 ] Default workflow, editable Closed status [ 12745682 ]
        Mark Thomas made changes -
        Project Import Mon Apr 06 02:11:23 UTC 2015 [ 1428286283443 ]
        Mark Thomas made changes -
        Workflow jira [ 12971413 ] Default workflow, editable Closed status [ 12979146 ]
        Transition Time In Source Status Execution Times Last Executer Last Execution Date
        Open Open In Progress In Progress
        14d 4h 11m 1 Cédric Champeau 30/Aug/11 15:39
        In Progress In Progress Resolved Resolved
        12h 52m 1 Cédric Champeau 31/Aug/11 04:32
        Resolved Resolved Closed Closed
        7d 10h 41m 1 Paul King 07/Sep/11 15:13

          People

          • Assignee:
            Cédric Champeau
            Reporter:
            Carsten Mjartan
          • Votes:
            1 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development