[GROOVY-9379] Binding shadows getters in script or base script

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.0.0-rc-2
• Component/s: groovy-runtime
• Environment: CentOS 8, OpenJDK 11
• Assignee: Unassigned
• Reporter: Jochen Eddelbuettel
• Created: 29/Jan/20 14:19
• Updated: 22/Jun/20 15:00

Description

 

boolean isPasswordOK() { false }
binding.setVariable("passwordOK", true)
if (passwordOK) print "You're in"

Accessing a variable available in the binding takes precedent over utilizing a getter. This is extremely risky if the script author doesn't have full control over the binding and forgets to call all his getters explicitly, especially when they come from a BaseScript and he/she uses the code suggestions from IntelliJ, which show any getters as simple property names.

The expected behaviour of the code above, should be NOT to let anyone in.