public class SandboxTransformer
extends org.codehaus.groovy.control.customizers.CompilationCustomizer
Sometimes you'd like to run Groovy scripts in a sandbox environment, where you only want it to access limited subset of the rest of JVM. This transformation makes that possible by letting you inspect every step of the script execution when it makes method calls and property/field/array access.
Once the script is transformed, every intercepted operation results in a call to Checker
,
which further forwards the call to GroovyInterceptor
for inspection.
To use it, add it to the CompilerConfiguration
, like this:
def cc = new CompilerConfiguration() cc.addCompilationCustomizers(new SandboxTransformer()) sh = new GroovyShell(cc)
By default, this code intercepts everything that can be intercepted, which are:
You can disable interceptions selectively by setting respective interceptXXX
flags to false
.
There'll be a substantial hit to the performance of the execution.
Constructor and Description |
---|
SandboxTransformer() |
Modifier and Type | Method and Description |
---|---|
void |
call(org.codehaus.groovy.control.SourceUnit source,
org.codehaus.groovy.classgen.GeneratorContext context,
org.codehaus.groovy.ast.ClassNode classNode) |
org.codehaus.groovy.ast.ClassCodeExpressionTransformer |
createVisitor(org.codehaus.groovy.control.SourceUnit source)
Deprecated.
|
org.codehaus.groovy.ast.ClassCodeExpressionTransformer |
createVisitor(org.codehaus.groovy.control.SourceUnit source,
org.codehaus.groovy.ast.ClassNode clazz) |
static boolean |
mightBePositionalArgumentConstructor(org.codehaus.groovy.ast.expr.VariableExpression ve)
Checks if a
DeclarationExpression.getVariableExpression() might induce DefaultTypeTransformation.castToType(java.lang.Object, java.lang.Class) to call a constructor. |
void |
processConstructors(org.codehaus.groovy.ast.ClassCodeExpressionTransformer visitor,
org.codehaus.groovy.ast.ClassNode classNode)
Apply SECURITY-582 fix to constructors.
|
public void call(org.codehaus.groovy.control.SourceUnit source, org.codehaus.groovy.classgen.GeneratorContext context, org.codehaus.groovy.ast.ClassNode classNode)
call
in class org.codehaus.groovy.control.CompilationUnit.PrimaryClassNodeOperation
public void processConstructors(org.codehaus.groovy.ast.ClassCodeExpressionTransformer visitor, org.codehaus.groovy.ast.ClassNode classNode)
@Deprecated public org.codehaus.groovy.ast.ClassCodeExpressionTransformer createVisitor(org.codehaus.groovy.control.SourceUnit source)
public org.codehaus.groovy.ast.ClassCodeExpressionTransformer createVisitor(org.codehaus.groovy.control.SourceUnit source, org.codehaus.groovy.ast.ClassNode clazz)
public static boolean mightBePositionalArgumentConstructor(org.codehaus.groovy.ast.expr.VariableExpression ve)
DeclarationExpression.getVariableExpression()
might induce DefaultTypeTransformation.castToType(java.lang.Object, java.lang.Class)
to call a constructor.
If so, Checker.checkedCast(java.lang.Class<?>, java.lang.Object, boolean, boolean, boolean)
should be run.
Will be false for example if the declared type is an array, abstract
, or unspecified (just def
).
Not yet supporting DeclarationExpression.getTupleExpression()
on LHS;
and currently ignoring BinaryExpression.getRightExpression()
though some might not possibly be arrays, Collection
s, or Map
s.Copyright © 2017. All rights reserved.