[GROOVY-8135] SecureASTCustomizer whitelist does not work

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.4.8
• Fix Version/s: 2.4.12
• Flags: Important
• Assignee: John Wagenleitner
• Reporter: Radoslav Ivanov
• Created: 29/Mar/17 02:14
• Updated: 06/Mar/18 23:14
• Resolved: 07/May/17 05:52

Description

The example [1] throws a SecurityException[2]

Details

1. Source code

SecureASTCustomizer customizer = new SecureASTCustomizer();
customizer.setIndirectImportCheckEnabled(true);

List<String> starImportsWhitelist = new ArrayList<String>();
starImportsWhitelist.add("java.lang");
customizer.setStarImportsWhitelist(starImportsWhitelist);

CompilerConfiguration cc = new CompilerConfiguration();
cc.addCompilationCustomizers(customizer);

ClassLoader parent = getClass().getClassLoader();
GroovyClassLoader loader = new GroovyClassLoader(parent, cc);

loader.parseClass("Object[] array = new Object[0]; array.size()");

2. Exception
Caused by: java.lang.SecurityException: Importing [[Ljava.lang.Object;] is not allowed
at org.codehaus.groovy.control.customizers.SecureASTCustomizer.assertImportIsAllowed(SecureASTCustomizer.java:608)
at org.codehaus.groovy.control.customizers.SecureASTCustomizer.access$800(SecureASTCustomizer.java:121)
at org.codehaus.groovy.control.customizers.SecureASTCustomizer$SecuringCodeVisitor.assertExpressionAuthorized(SecureASTCustomizer.java:702)

Issue Links

• links to: GitHub Pull Request #538