Package org.codehaus.groovy.control.customizers

Class SecureASTCustomizer

  • All Implemented Interfaces:
    CompilationUnit.IPrimaryClassNodeOperation
    public class SecureASTCustomizer
extends CompilationCustomizer
    This customizer allows securing source code by controlling what code constructs are permitted. This is typically done when using Groovy for its scripting or domain specific language (DSL) features. For example, if you only want to allow arithmetic operations in a groovy shell, you can configure this customizer to restrict package imports, method calls and so on.

    Most of the security customization options found in this class work with either allowed or disallowed lists. This means that, for a single option, you can set an allowed list OR a disallowed list, but not both. You can mix allowed/disallowed strategies for different options. For example, you can have an allowed import list and a disallowed tokens list.

    The recommended way of securing shells is to use allowed lists because it is guaranteed that future features of the Groovy language won't be accidentally allowed unless explicitly added to the allowed list. Using disallowed lists, you can limit the features of the language constructs supported by your shell by opting out, but new language features are then implicitly also available and this may not be desirable. The implication is that you might need to update your configuration with each new release.

    If neither an allowed list nor a disallowed list is set, then everything is permitted.

    Combinations of import and star import constraints are authorized as long as you use the same type of list for both. For example, you may use an import allowed list and a star import allowed list together, but you cannot use an import allowed list with a star import disallowed list. Static imports are handled separately, meaning that disallowing an import does not prevent from allowing a static import.

    Eventually, if the features provided here are not sufficient, you may implement custom AST filtering handlers, either implementing the SecureASTCustomizer.StatementChecker interface or SecureASTCustomizer.ExpressionChecker interface then register your handlers thanks to the addExpressionCheckers(org.codehaus.groovy.control.customizers.SecureASTCustomizer.ExpressionChecker...) and addStatementCheckers(org.codehaus.groovy.control.customizers.SecureASTCustomizer.StatementChecker...) methods.

    Here is an example of usage. We will create a groovy classloader which only supports arithmetic operations and imports the java.lang.Math classes by default. 

     final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
     final SecureASTCustomizer secure = new SecureASTCustomizer()
     secure.with {
         closuresAllowed = false
         methodDefinitionAllowed = false

         allowedImports = []
         allowedStaticImports = []
         allowedStaticStarImports = ['java.lang.Math'] // only java.lang.Math is allowed

         allowedTokens = [
                 PLUS,
                 MINUS,
                 MULTIPLY,
                 DIVIDE,
                 MOD,
                 POWER,
                 PLUS_PLUS,
                 MINUS_MINUS,
                 COMPARE_EQUAL,
                 COMPARE_NOT_EQUAL,
                 COMPARE_LESS_THAN,
                 COMPARE_LESS_THAN_EQUAL,
                 COMPARE_GREATER_THAN,
                 COMPARE_GREATER_THAN_EQUAL,
         ].asImmutable()

         allowedConstantTypesClasses = [
                 Integer,
                 Float,
                 Long,
                 Double,
                 BigDecimal,
                 Integer.TYPE,
                 Long.TYPE,
                 Float.TYPE,
                 Double.TYPE
         ].asImmutable()

         allowedReceiversClasses = [
                 Math,
                 Integer,
                 Float,
                 Double,
                 Long,
                 BigDecimal
         ].asImmutable()
     }
     CompilerConfiguration config = new CompilerConfiguration()
     config.addCompilationCustomizers(imports, secure)
     GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)
    Since:
    1.8.0

    • Constructor Detail

      • SecureASTCustomizer

        public SecureASTCustomizer()

    • Method Detail

      • isMethodDefinitionAllowed

        public boolean isMethodDefinitionAllowed()

      • setMethodDefinitionAllowed

        public void setMethodDefinitionAllowed​(boolean methodDefinitionAllowed)

      • isPackageAllowed

        public boolean isPackageAllowed()

      • isClosuresAllowed

        public boolean isClosuresAllowed()

      • setClosuresAllowed

        public void setClosuresAllowed​(boolean closuresAllowed)

      • setPackageAllowed

        public void setPackageAllowed​(boolean packageAllowed)

      • getDisallowedImports

        public List<String> getDisallowedImports()

      • setDisallowedImports

        public void setDisallowedImports​(List<String> disallowedImports)

      • getAllowedImports

        public List<String> getAllowedImports()

      • setAllowedImports

        public void setAllowedImports​(List<String> allowedImports)

      • getDisallowedStarImports

        public List<String> getDisallowedStarImports()

      • setDisallowedStarImports

        public void setDisallowedStarImports​(List<String> disallowedStarImports)

      • getAllowedStarImports

        public List<String> getAllowedStarImports()

      • setAllowedStarImports

        public void setAllowedStarImports​(List<String> allowedStarImports)

      • getDisallowedStaticImports

        public List<String> getDisallowedStaticImports()

      • setDisallowedStaticImports

        public void setDisallowedStaticImports​(List<String> disallowedStaticImports)

      • getAllowedStaticImports

        public List<String> getAllowedStaticImports()

      • setAllowedStaticImports

        public void setAllowedStaticImports​(List<String> allowedStaticImports)

      • getDisallowedStaticStarImports

        public List<String> getDisallowedStaticStarImports()

      • setDisallowedStaticStarImports

        public void setDisallowedStaticStarImports​(List<String> disallowedStaticStarImports)

      • getAllowedStaticStarImports

        public List<String> getAllowedStaticStarImports()

      • setAllowedStaticStarImports

        public void setAllowedStaticStarImports​(List<String> allowedStaticStarImports)

      • getDisallowedExpressions

        public List<Class<? extends Expression>> getDisallowedExpressions()

      • setDisallowedExpressions

        public void setDisallowedExpressions​(List<Class<? extends Expression>> disallowedExpressions)

      • setAllowedExpressions

        public void setAllowedExpressions​(List<Class<? extends Expression>> allowedExpressions)

      • getDisallowedStatements

        public List<Class<? extends Statement>> getDisallowedStatements()

      • setDisallowedStatements

        public void setDisallowedStatements​(List<Class<? extends Statement>> disallowedStatements)

      • setAllowedStatements

        public void setAllowedStatements​(List<Class<? extends Statement>> allowedStatements)

      • isIndirectImportCheckEnabled

        public boolean isIndirectImportCheckEnabled()

      • setIndirectImportCheckEnabled

        public void setIndirectImportCheckEnabled​(boolean indirectImportCheckEnabled)
        Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.
        Parameters:
        indirectImportCheckEnabled - set to true to enable indirect checks

      • getDisallowedTokens

        public List<Integer> getDisallowedTokens()

      • setDisallowedTokens

        public void setDisallowedTokens​(List<Integer> disallowedTokens)
        Sets the list of tokens which are not permitted.
        Parameters:
        disallowedTokens - the tokens. The values of the tokens must be those of Types

      • getAllowedTokens

        public List<Integer> getAllowedTokens()

      • setAllowedTokens

        public void setAllowedTokens​(List<Integer> allowedTokens)
        Sets the list of tokens which are permitted.
        Parameters:
        allowedTokens - the tokens. The values of the tokens must be those of Types

      • getDisallowedConstantTypes

        public List<String> getDisallowedConstantTypes()

      • setConstantTypesBlackList

        public void setConstantTypesBlackList​(List<String> constantTypesBlackList)

      • getAllowedConstantTypes

        public List<String> getAllowedConstantTypes()

      • setAllowedConstantTypes

        public void setAllowedConstantTypes​(List<String> allowedConstantTypes)

      • setAllowedConstantTypesClasses

        public void setAllowedConstantTypesClasses​(List<Class> allowedConstantTypes)
        An alternative way of setting constant types.
        Parameters:
        allowedConstantTypes - a list of classes.

      • setDisallowedConstantTypesClasses

        public void setDisallowedConstantTypesClasses​(List<Class> disallowedConstantTypes)
        An alternative way of setting constant types.
        Parameters:
        disallowedConstantTypes - a list of classes.

      • getDisallowedReceivers

        public List<String> getDisallowedReceivers()

      • setDisallowedReceivers

        public void setDisallowedReceivers​(List<String> disallowedReceivers)
        Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be relatively simple to bypass any disallowed list unless the disallowed receivers list contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also have MethodPointerExpression in the disallowed expressions list for the disallowed receivers list to function as a security check.
        Parameters:
        disallowedReceivers - the list of refused classes, as fully qualified names

      • setDisallowedReceiversClasses

        public void setDisallowedReceiversClasses​(List<Class> disallowedReceivers)
        An alternative way of setting receiver classes.
        Parameters:
        disallowedReceivers - a list of classes.

      • getAllowedReceivers

        public List<String> getAllowedReceivers()

      • setAllowedReceivers

        public void setAllowedReceivers​(List<String> allowedReceivers)
        Sets the list of classes which may accept method calls.
        Parameters:
        allowedReceivers - the list of accepted classes, as fully qualified names

      • setAllowedReceiversClasses

        public void setAllowedReceiversClasses​(List<Class> allowedReceivers)
        An alternative way of setting receiver classes.
        Parameters:
        allowedReceivers - a list of classes.

      • checkMethodDefinitionAllowed

        protected void checkMethodDefinitionAllowed​(ClassNode owner)

      • assertStarImportIsAllowed

        protected void assertStarImportIsAllowed​(String packageName)

      • assertImportIsAllowed

        protected void assertImportIsAllowed​(String className)

      • assertStaticImportIsAllowed

        protected void assertStaticImportIsAllowed​(String member,
                                           String className)