Class SecureASTCustomizer
- All Implemented Interfaces:
- CompilationUnit.IPrimaryClassNodeOperation
Most of the security customization options found in this class work with either allowed or disallowed lists. This means that, for a single option, you can set an allowed list OR a disallowed list, but not both. You can mix allowed/disallowed strategies for different options. For example, you can have an allowed import list and a disallowed tokens list.
The recommended way of securing shells is to use allowed lists because it is guaranteed that future features of the Groovy language won't be accidentally allowed unless explicitly added to the allowed list. Using disallowed lists, you can limit the features of the language constructs supported by your shell by opting out, but new language features are then implicitly also available and this may not be desirable. The implication is that you might need to update your configuration with each new release.
If neither an allowed list nor a disallowed list is set, then everything is permitted.
Combinations of import and star import constraints are authorized as long as you use the same type of list for both. For example, you may use an import allowed list and a star import allowed list together, but you cannot use an import allowed list with a star import disallowed list. Static imports are handled separately, meaning that disallowing an import does not prevent from allowing a static import.
 Eventually, if the features provided here are not sufficient, you may implement custom AST filtering handlers, either
 implementing the SecureASTCustomizer.StatementChecker interface or SecureASTCustomizer.ExpressionChecker interface then register your
 handlers thanks to the addExpressionCheckers(ExpressionChecker...)
 and addStatementCheckers(StatementChecker...)
 methods.
 
 Here is an example of usage. We will create a groovy classloader which only supports arithmetic operations and imports
 the java.lang.Math classes by default.
 
 final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
 final SecureASTCustomizer secure = new SecureASTCustomizer()
 secure.with {
     closuresAllowed = false
     methodDefinitionAllowed = false
     allowedImports = []
     allowedStaticImports = []
     allowedStaticStarImports = ['java.lang.Math'] // only java.lang.Math is allowed
     allowedTokens = [
             PLUS,
             MINUS,
             MULTIPLY,
             DIVIDE,
             MOD,
             POWER,
             PLUS_PLUS,
             MINUS_MINUS,
             COMPARE_EQUAL,
             COMPARE_NOT_EQUAL,
             COMPARE_LESS_THAN,
             COMPARE_LESS_THAN_EQUAL,
             COMPARE_GREATER_THAN,
             COMPARE_GREATER_THAN_EQUAL,
     ].asImmutable()
     allowedConstantTypesClasses = [
             Integer,
             Float,
             Long,
             Double,
             BigDecimal,
             Integer.TYPE,
             Long.TYPE,
             Float.TYPE,
             Double.TYPE
     ].asImmutable()
     allowedReceiversClasses = [
             Math,
             Integer,
             Float,
             Double,
             Long,
             BigDecimal
     ].asImmutable()
 }
 CompilerConfiguration config = new CompilerConfiguration()
 config.addCompilationCustomizers(imports, secure)
 GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)
  
 
  Note: SecureASTCustomizer allows you to lock down the grammar of scripts but by itself isn't intended
  to be the complete solution of all security issues when running scripts on the JVM. You might also want to
  consider setting the groovy.grape.enable System property to false, augmenting use of the customizer
  with additional techniques, and following standard security principles for JVM applications.
  
For more information, please read:
- Since:
- 1.8.0
- 
Nested Class SummaryNested ClassesModifier and TypeClassDescriptionstatic interfaceThis interface allows the user to provide a custom expression checker if the dis/allowed expression lists are not sufficientprotected classThis visitor directly implements theGroovyCodeVisitorinterface instead of using theCodeVisitorSupportclass to make sure that future features of the language gets managed by this visitor.static interfaceThis interface allows the user to provide a custom statement checker if the dis/allowed statement lists are not sufficient
- 
Constructor SummaryConstructors
- 
Method SummaryModifier and TypeMethodDescriptionvoidvoidaddStatementCheckers(SecureASTCustomizer.StatementChecker... checkers) protected voidassertImportIsAllowed(String className) protected voidassertStarImportIsAllowed(String packageName) protected voidassertStaticImportIsAllowed(String member, String className) voidcall(SourceUnit source, GeneratorContext context, ClassNode classNode) protected voidprotected GroovyCodeVisitorprotected static List<MethodNode>filterMethods(ClassNode owner) List<Class<? extends Expression>>Deprecated.Deprecated.List<Class<? extends Expression>>List<Class<? extends Expression>>Deprecated.List<Class<? extends Expression>>Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.Deprecated.booleanbooleanbooleanbooleanvoidsetAllowedConstantTypes(List<String> allowedConstantTypes) voidsetAllowedConstantTypesClasses(List<Class> allowedConstantTypes) An alternative way of setting constant types.voidsetAllowedExpressions(List<Class<? extends Expression>> allowedExpressions) voidsetAllowedImports(List<String> allowedImports) voidsetAllowedReceivers(List<String> allowedReceivers) Sets the list of classes which may accept method calls.voidsetAllowedReceiversClasses(List<Class> allowedReceivers) An alternative way of settingreceiver classes.voidsetAllowedStarImports(List<String> allowedStarImports) voidsetAllowedStatements(List<Class<? extends Statement>> allowedStatements) voidsetAllowedStaticImports(List<String> allowedStaticImports) voidsetAllowedStaticStarImports(List<String> allowedStaticStarImports) voidsetAllowedTokens(List<Integer> allowedTokens) Sets the list of tokens which are permitted.voidsetClosuresAllowed(boolean closuresAllowed) voidsetConstantTypesBlackList(List<String> constantTypesBlackList) voidsetConstantTypesClassesBlackList(List<Class> disallowedConstantTypes) Deprecated.voidsetConstantTypesClassesWhiteList(List<Class> allowedConstantTypes) Deprecated.voidsetConstantTypesWhiteList(List<String> allowedConstantTypes) Deprecated.voidsetDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes) An alternative way of setting constant types.voidsetDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions) voidsetDisallowedImports(List<String> disallowedImports) voidsetDisallowedReceivers(List<String> disallowedReceivers) Sets the list of classes which deny method calls.voidsetDisallowedReceiversClasses(List<Class> disallowedReceivers) An alternative way of settingreceiver classes.voidsetDisallowedStarImports(List<String> disallowedStarImports) voidsetDisallowedStatements(List<Class<? extends Statement>> disallowedStatements) voidsetDisallowedStaticImports(List<String> disallowedStaticImports) voidsetDisallowedStaticStarImports(List<String> disallowedStaticStarImports) voidsetDisallowedTokens(List<Integer> disallowedTokens) Sets the list of tokens which are not permitted.voidsetExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions) Deprecated.voidsetExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions) Deprecated.voidsetImportsBlacklist(List<String> disallowedImports) Deprecated.voidsetImportsWhitelist(List<String> allowedImports) Deprecated.voidsetIndirectImportCheckEnabled(boolean indirectImportCheckEnabled) Set this option to true if you want your import rules to be checked against every class node.voidsetMethodDefinitionAllowed(boolean methodDefinitionAllowed) voidsetPackageAllowed(boolean packageAllowed) voidsetReceiversBlackList(List<String> disallowedReceivers) Deprecated.voidsetReceiversClassesBlackList(List<Class> disallowedReceivers) Deprecated.voidsetReceiversClassesWhiteList(List<Class> allowedReceivers) Deprecated.voidsetReceiversWhiteList(List<String> allowedReceivers) Deprecated.voidsetStarImportsBlacklist(List<String> disallowedStarImports) Deprecated.voidsetStarImportsWhitelist(List<String> allowedStarImports) Deprecated.voidsetStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements) Deprecated.voidsetStatementsWhitelist(List<Class<? extends Statement>> allowedStatements) Deprecated.voidsetStaticImportsBlacklist(List<String> disallowedStaticImports) Deprecated.voidsetStaticImportsWhitelist(List<String> allowedStaticImports) Deprecated.voidsetStaticStarImportsBlacklist(List<String> disallowedStaticStarImports) Deprecated.voidsetStaticStarImportsWhitelist(List<String> allowedStaticStarImports) Deprecated.voidsetTokensBlacklist(List<Integer> disallowedTokens) Deprecated.voidsetTokensWhitelist(List<Integer> allowedTokens) Deprecated.Methods inherited from class org.codehaus.groovy.control.customizers.CompilationCustomizergetPhaseMethods inherited from class java.lang.Objectclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitMethods inherited from interface org.codehaus.groovy.control.CompilationUnit.IPrimaryClassNodeOperationdoPhaseOperation, needSortedInput
- 
Constructor Details- 
SecureASTCustomizerpublic SecureASTCustomizer()
 
- 
- 
Method Details- 
isMethodDefinitionAllowedpublic boolean isMethodDefinitionAllowed()
- 
setMethodDefinitionAllowedpublic void setMethodDefinitionAllowed(boolean methodDefinitionAllowed) 
- 
isPackageAllowedpublic boolean isPackageAllowed()
- 
isClosuresAllowedpublic boolean isClosuresAllowed()
- 
setClosuresAllowedpublic void setClosuresAllowed(boolean closuresAllowed) 
- 
setPackageAllowedpublic void setPackageAllowed(boolean packageAllowed) 
- 
getDisallowedImports
- 
getImportsBlacklistDeprecated.Legacy alias forgetDisallowedImports()
- 
setDisallowedImports
- 
setImportsBlacklistDeprecated.Legacy alias forsetDisallowedImports(List)
- 
getAllowedImports
- 
getImportsWhitelistDeprecated.Legacy alias forgetAllowedImports()
- 
setAllowedImports
- 
setImportsWhitelistDeprecated.Legacy alias forsetAllowedImports(List)
- 
getDisallowedStarImports
- 
getStarImportsBlacklistDeprecated.Legacy alias forgetDisallowedStarImports()
- 
setDisallowedStarImports
- 
setStarImportsBlacklistDeprecated.Legacy alias forsetDisallowedStarImports(List)
- 
getAllowedStarImports
- 
getStarImportsWhitelistDeprecated.Legacy alias forgetAllowedStarImports()
- 
setAllowedStarImports
- 
setStarImportsWhitelistDeprecated.Legacy alias forsetAllowedStarImports(List)
- 
getDisallowedStaticImports
- 
getStaticImportsBlacklistDeprecated.Legacy alias forgetDisallowedStaticImports()
- 
setDisallowedStaticImports
- 
setStaticImportsBlacklistDeprecated.Legacy alias forsetDisallowedStaticImports(List)
- 
getAllowedStaticImports
- 
getStaticImportsWhitelistDeprecated.Legacy alias forgetAllowedStaticImports()
- 
setAllowedStaticImports
- 
setStaticImportsWhitelistDeprecated.Legacy alias forsetAllowedStaticImports(List)
- 
getDisallowedStaticStarImports
- 
getStaticStarImportsBlacklistDeprecated.Legacy alias forgetDisallowedStaticStarImports()
- 
setDisallowedStaticStarImports
- 
setStaticStarImportsBlacklistDeprecated.Legacy alias forsetDisallowedStaticStarImports(List)
- 
getAllowedStaticStarImports
- 
getStaticStarImportsWhitelistDeprecated.Legacy alias forgetAllowedStaticStarImports()
- 
setAllowedStaticStarImports
- 
setStaticStarImportsWhitelistDeprecated.Legacy alias forsetAllowedStaticStarImports(List)
- 
getDisallowedExpressions
- 
getExpressionsBlacklistDeprecated.Legacy alias forgetDisallowedExpressions()
- 
setDisallowedExpressions
- 
setExpressionsBlacklist@Deprecated public void setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions) Deprecated.Legacy alias forsetDisallowedExpressions(List)
- 
getAllowedExpressions
- 
getExpressionsWhitelistDeprecated.Legacy alias forgetAllowedExpressions()
- 
setAllowedExpressions
- 
setExpressionsWhitelist@Deprecated public void setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions) Deprecated.Legacy alias forsetAllowedExpressions(List)
- 
getDisallowedStatements
- 
getStatementsBlacklistDeprecated.Legacy alias forgetDisallowedStatements()
- 
setDisallowedStatements
- 
setStatementsBlacklist@Deprecated public void setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements) Deprecated.Legacy alias forsetDisallowedStatements(List)
- 
getAllowedStatements
- 
getStatementsWhitelistDeprecated.Legacy alias forgetAllowedStatements()
- 
setAllowedStatements
- 
setStatementsWhitelistDeprecated.Legacy alias forsetAllowedStatements(List)
- 
isIndirectImportCheckEnabledpublic boolean isIndirectImportCheckEnabled()
- 
setIndirectImportCheckEnabledpublic void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled) Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.- Parameters:
- indirectImportCheckEnabled- set to true to enable indirect checks
 
- 
getDisallowedTokens
- 
getTokensBlacklistDeprecated.Legacy alias forgetDisallowedTokens()
- 
setDisallowedTokensSets the list of tokens which are not permitted.- Parameters:
- disallowedTokens- the tokens. The values of the tokens must be those of- Types
 
- 
setTokensBlacklistDeprecated.Legacy alias forsetDisallowedTokens(List).
- 
getAllowedTokens
- 
getTokensWhitelistDeprecated.Legacy alias forgetAllowedTokens()
- 
setAllowedTokensSets the list of tokens which are permitted.- Parameters:
- allowedTokens- the tokens. The values of the tokens must be those of- Types
 
- 
setTokensWhitelistDeprecated.Legacy alias forsetAllowedTokens(List)
- 
addStatementCheckers
- 
addExpressionCheckers
- 
getDisallowedConstantTypes
- 
getConstantTypesBlackListDeprecated.Legacy alias forgetDisallowedConstantTypes()
- 
setConstantTypesBlackList
- 
getAllowedConstantTypes
- 
getConstantTypesWhiteListDeprecated.Legacy alias forgetAllowedStatements()
- 
setAllowedConstantTypes
- 
setConstantTypesWhiteListDeprecated.Legacy alias forsetAllowedConstantTypes(List)
- 
setAllowedConstantTypesClassesAn alternative way of setting constant types.- Parameters:
- allowedConstantTypes- a list of classes.
 
- 
setConstantTypesClassesWhiteListDeprecated.Legacy alias forsetAllowedConstantTypesClasses(List)
- 
setDisallowedConstantTypesClassesAn alternative way of setting constant types.- Parameters:
- disallowedConstantTypes- a list of classes.
 
- 
setConstantTypesClassesBlackListDeprecated.Legacy alias forsetDisallowedConstantTypesClasses(List)
- 
getDisallowedReceivers
- 
getReceiversBlackListDeprecated.Legacy alias forgetDisallowedReceivers()
- 
setDisallowedReceiversSets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be relatively simple to bypass any disallowed list unless the disallowed receivers list contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also have MethodPointerExpression in the disallowed expressions list for the disallowed receivers list to function as a security check.- Parameters:
- disallowedReceivers- the list of refused classes, as fully qualified names
 
- 
setReceiversBlackListDeprecated.Legacy alias forsetDisallowedReceivers(List)
- 
setDisallowedReceiversClassesAn alternative way of settingreceiver classes.- Parameters:
- disallowedReceivers- a list of classes.
 
- 
setReceiversClassesBlackListDeprecated.Legacy alias forsetDisallowedReceiversClasses(List).
- 
getAllowedReceivers
- 
getReceiversWhiteListDeprecated.Legacy alias forgetAllowedReceivers()
- 
setAllowedReceiversSets the list of classes which may accept method calls.- Parameters:
- allowedReceivers- the list of accepted classes, as fully qualified names
 
- 
setReceiversWhiteListDeprecated.Legacy alias forsetAllowedReceivers(List)
- 
setAllowedReceiversClassesAn alternative way of settingreceiver classes.- Parameters:
- allowedReceivers- a list of classes.
 
- 
setReceiversClassesWhiteListDeprecated.Legacy alias forsetAllowedReceiversClasses(List)
- 
callpublic void call(SourceUnit source, GeneratorContext context, ClassNode classNode) throws CompilationFailedException - Throws:
- CompilationFailedException
 
- 
createGroovyCodeVisitor
- 
checkMethodDefinitionAllowed
- 
filterMethods
- 
assertStarImportIsAllowed
- 
assertImportIsAllowed
- 
assertStaticImportIsAllowed
 
-