Constructor Detail

• public SecureASTCustomizer()

Method Detail

• public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)

• public void addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)

• @Override public void call(SourceUnit source, GeneratorContext context, ClassNode classNode)

• public List<String> getConstantTypesBlackList()

• public List<String> getConstantTypesWhiteList()

• public List<Class<? extends Expression>> getExpressionsBlacklist()

• public List<Class<? extends Expression>> getExpressionsWhitelist()

• public List<String> getImportsBlacklist()

• public List<String> getImportsWhitelist()

• public List<String> getReceiversBlackList()

• public List<String> getReceiversWhiteList()

• public List<String> getStarImportsBlacklist()

• public List<String> getStarImportsWhitelist()

• public List<Class<? extends Statement>> getStatementsBlacklist()

• public List<Class<? extends Statement>> getStatementsWhitelist()

• public List<String> getStaticImportsBlacklist()

• public List<String> getStaticImportsWhitelist()

• public List<String> getStaticStarImportsBlacklist()

• public List<String> getStaticStarImportsWhitelist()

• public List<Integer> getTokensBlacklist()

• public List<Integer> getTokensWhitelist()

• public boolean isClosuresAllowed()

• public boolean isIndirectImportCheckEnabled()

• public boolean isMethodDefinitionAllowed()

• public boolean isPackageAllowed()

• public void setClosuresAllowed(boolean closuresAllowed)

• public void setConstantTypesBlackList(List<String> constantTypesBlackList)

• public void setConstantTypesClassesBlackList(List<Class> constantTypesBlackList)

  An alternative way of setting constant types.

  Parameters:

  constantTypesBlackList - a list of classes.

• public void setConstantTypesClassesWhiteList(List<Class> constantTypesWhiteList)

  An alternative way of setting constant types.

  Parameters:

  constantTypesWhiteList - a list of classes.

• public void setConstantTypesWhiteList(List<String> constantTypesWhiteList)

• public void setExpressionsBlacklist(List<Class<? extends Expression>> expressionsBlacklist)

• public void setExpressionsWhitelist(List<Class<? extends Expression>> expressionsWhitelist)

• public void setImportsBlacklist(List<String> importsBlacklist)

• public void setImportsWhitelist(List<String> importsWhitelist)

• public void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)

  Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.

  Parameters:

  indirectImportCheckEnabled - set to true to enable indirect checks

• public void setMethodDefinitionAllowed(boolean methodDefinitionAllowed)

• public void setPackageAllowed(boolean packageAllowed)

• public void setReceiversBlackList(List<String> receiversBlackList)

  Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be reletively simple to bypass any blacklist unless the receivers blacklist contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also blacklist MethodPointerExpression in the expressions blacklist for the receivers blacklist to function as a security check.

  Parameters:

  receiversBlackList - the list of refused classes, as fully qualified names

• public void setReceiversClassesBlackList(List<Class> receiversBlacklist)

  An alternative way of setting receiver classes.

  Parameters:

  receiversBlacklist - a list of classes.

• public void setReceiversClassesWhiteList(List<Class> receiversWhitelist)

  An alternative way of setting receiver classes.

  Parameters:

  receiversWhitelist - a list of classes.

• public void setReceiversWhiteList(List<String> receiversWhiteList)

  Sets the list of classes which may accept method calls.

  Parameters:

  receiversWhiteList - the list of accepted classes, as fully qualified names

• public void setStarImportsBlacklist(List<String> starImportsBlacklist)

• public void setStarImportsWhitelist(List<String> starImportsWhitelist)

• public void setStatementsBlacklist(List<Class<? extends Statement>> statementsBlacklist)

• public void setStatementsWhitelist(List<Class<? extends Statement>> statementsWhitelist)

• public void setStaticImportsBlacklist(List<String> staticImportsBlacklist)

• public void setStaticImportsWhitelist(List<String> staticImportsWhitelist)

• public void setStaticStarImportsBlacklist(List<String> staticStarImportsBlacklist)

• public void setStaticStarImportsWhitelist(List<String> staticStarImportsWhitelist)

• public void setTokensBlacklist(List<Integer> tokensBlacklist)

  Sets the list of tokens which are blacklisted.

  Parameters:

  tokensBlacklist - the tokens. The values of the tokens must be those of Types

• public void setTokensWhitelist(List<Integer> tokensWhitelist)

  Sets the list of tokens which are whitelisted.

  Parameters:

  tokensWhitelist - the tokens. The values of the tokens must be those of Types