public class GroovySandbox extends Object
Modifier and Type | Method and Description |
---|---|
static ClassLoader |
createSecureClassLoader(ClassLoader base)
Prepares a classloader for Groovy shell for sandboxing.
|
static org.codehaus.groovy.control.CompilerConfiguration |
createSecureCompilerConfiguration()
Prepares a compiler configuration the sandbox.
|
static Object |
run(groovy.lang.Script script,
Whitelist whitelist)
Runs a script in the sandbox.
|
static <V> V |
runInSandbox(Callable<V> c,
Whitelist whitelist)
Runs a function in the sandbox.
|
static void |
runInSandbox(Runnable r,
Whitelist whitelist)
Runs a block in the sandbox.
|
static void |
runInSandbox(groovy.lang.Script script,
Whitelist whitelist)
Deprecated.
Use
run(groovy.lang.Script, org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist) to ensure that methods defined inside the script do not need to be whitelisted. |
@Nonnull public static org.codehaus.groovy.control.CompilerConfiguration createSecureCompilerConfiguration()
When creating GroovyShell
with this CompilerConfiguration
,
you also have to use createSecureClassLoader(ClassLoader)
to wrap
a classloader of your choice into sandbox-aware one.
Otherwise the classloader that you provide to GroovyShell
might
have its own copy of groovy-sandbox, which lets the code escape the sandbox.
@Nonnull public static ClassLoader createSecureClassLoader(ClassLoader base)
createSecureCompilerConfiguration()
for the discussion.public static void runInSandbox(@Nonnull Runnable r, @Nonnull Whitelist whitelist) throws RejectedAccessException
createSecureCompilerConfiguration()
to prepare the Groovy shell.
Use run(groovy.lang.Script, org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist)
instead whenever possible.r
- a block of code during whose execution all calls are interceptedwhitelist
- the whitelist to use, such as Whitelist.all()
RejectedAccessException
- in case an attempted call was not whitelistedpublic static <V> V runInSandbox(@Nonnull Callable<V> c, @Nonnull Whitelist whitelist) throws Exception
createSecureCompilerConfiguration()
to prepare the Groovy shell.
Use run(groovy.lang.Script, org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist)
instead whenever possible.r
- a block of code during whose execution all calls are interceptedwhitelist
- the whitelist to use, such as Whitelist.all()
RejectedAccessException
- in case an attempted call was not whitelistedException
- in case the block threw some other exception@Deprecated public static void runInSandbox(@Nonnull groovy.lang.Script script, @Nonnull Whitelist whitelist) throws RejectedAccessException
run(groovy.lang.Script, org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist)
to ensure that methods defined inside the script do not need to be whitelisted.RejectedAccessException
public static Object run(@Nonnull groovy.lang.Script script, @Nonnull Whitelist whitelist) throws RejectedAccessException
createSecureCompilerConfiguration()
to prepare the Groovy shell.script
- a script ready to Script.run()
, created for example by GroovyShell.parse(String)
whitelist
- the whitelist to use, such as Whitelist.all()
RejectedAccessException
- in case an attempted call was not whitelistedCopyright © 2015. All rights reserved.