Re: Best practice to limit the capability of Groovy classes
Tommy Svensson <[email protected]> Sun, 17 Aug 2025 10:19:24 +0200
| Newsgroups | gmane.comp.lang.groovy.user |
|---|---|
| Message-ID | <[email protected]> |
--68a191e8_625558ec_238a Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hmm ... how about educating your developers in what can be called, and wh= at shouldn't =3F As far as I know there are very few or no software langu= ages that supports such things. All that is needed is experience, experie= nce, and experience=21 Tommy Svensson tommy=40natusoft.se (mailto:tommy=40natusoft.se) P=C3=A5 17 augusti 2025 till 09:12:09, =46rancesco Chicchiricc=C3=B2 (ilg= rosso=40apache.org (mailto:ilgrosso=40apache.org)) skrev: > Hi Paul, > thank you for your answer. > > About sandbox, what do you think about =5B3=5D or =5B4=5D=3F Both seems= to be quite active, license-compliant and available from Maven Central. > > Also, do you have any example of ImportCustomizer / SecureASTCustomizer= to start from=3F I have only found =5B5=5D so far. > > Regards. > > =5B3=5D https://github.com/dalet-oss/groovy-sandbox > =5B4=5D https://github.com/craftercms/groovy-sandbox > =5B5=5D https://github.com/jenkinsci/script-security-plugin/blob/master= /src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/Reject= ASTTransformsCustomizer.java > > On 2025/08/16 21:31:36 Paul King wrote: > > Step 4 in your reference =5B2=5D is the key. > > > > You can provide an ImportCustomizer and a SecureASTCustomizer to limi= t > > imports and prohibit statements like =22System.exit()=22. As mentione= d in that > > article, that doesn't stop folks potentially using reflection or othe= r > > tricks to execute the exit() statement. You can start trying to lock = down > > such statements too. It becomes increasingly tricky to block all of t= he > > tricks without crippling what your users may legitimately want to exe= cute. > > So, having a sandbox is the next step. > > > > Using the security manager with a policy file, also mentioned in that= > > reference, has gone out of vogue and isn't supported in the latest JD= Ks. > > You'd more typically use a VM these days and set up a machine where i= t > > didn't matter if a script somehow managed to read the /etc/passwd fil= e (or > > whatever). > > > > We have been meaning to document best practices for a sandbox environ= ment > > but haven't found the cycles yet. We'd be super keen to work with you= to > > write something up if you make progress. > > > > Cheers, Paul. > > > > > > On Sat, Aug 16, 2025 at 5:13=E2=80=AFPM =46rancesco Chicchiricc=C3=B2= <ilgrosso=40apache.org> > > wrote: > > > > > Hi team, > > > Syncope is offering the possibility to extend / customize the base > > > behavior on every deployment by allowing to provide custom implemen= tations > > > of a few Java interfaces; such implementations can be provided eith= er as > > > Java or Groovy classes =5B1=5D, with the latter being particularly = attractive > > > as the machinery is set for runtime reload. > > > > > > I was wondering if there is any best-practice available to limit wh= at > > > could be done by Groovy classes (e.g. System.exit, spawning new pro= cesses, > > > etc.). > > > I found =5B2=5D and a few other references which looks anyway eithe= r old or > > > not for general purpose. > > > > > > Can you suggest something else=3F > > > > > > TIA > > > Regards. > > > > > > =5B1=5D > > > https://syncope.apache.org/docs/4.0/reference-guide.html=23implemen= tations > > > =5B2=5D > > > https://levelup.gitconnected.com/secure-groovy-script-execution-in-= a-sandbox-ea39f80ee87 > > > > > > -- > > > =46rancesco Chicchiricc=C3=B2 > > > > > > Tirasa - Open Source Excellence > > > http://www.tirasa.net/ > > > > > > Member at The Apache Software =46oundation > > > Syncope, Cocoon, Olingo, CX=46, OpenJPA > > > https://about.me/ilgrosso > > > > > > > > --68a191e8_625558ec_238a Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <html><head></head><body><font face=3D=22Helvetica=22 size=3D=224=22>Hmm = ... how about educating your developers in what can be called, and what s= houldn't =3F As far as I know there are very few or no software languages= that supports such things. All that is needed is experience, experience,= and experience=21</font><br> <br><div class=3D=22gmail=5Fsignature=22><= p style=3D=22margin: 0px; font-style: normal; font-variant-caps: normal; = font-stretch: normal; font-size: 21px; line-height: normal; font-family: = "Bradley Hand"; font-size-adjust: none; font-kerning: auto; fon= t-variant-alternates: normal; font-variant-ligatures: normal; font-varian= t-numeric: normal; font-variant-east-asian: normal; font-variant-position= : normal; font-variant-emoji: normal; font-feature-settings: normal; font= -optical-sizing: auto; font-variation-settings: normal;=22>Tommy Svensson= </p> <p style=3D=22margin: 0px; font-style: normal; font-variant-caps: normal;= font-stretch: normal; font-size: 21px; line-height: normal; font-family:= "Bradley Hand"; font-size-adjust: none; font-kerning: auto; fo= nt-variant-alternates: normal; font-variant-ligatures: normal; font-varia= nt-numeric: normal; font-variant-east-asian: normal; font-variant-positio= n: normal; font-variant-emoji: normal; font-feature-settings: normal; fon= t-optical-sizing: auto; font-variation-settings: normal;=22><a href=3D=22= mailto:tommy=40natusoft.se=22>tommy=40natusoft.se</a></p><div><p style=3D= =22margin: 0px; font-stretch: normal; font-size: 21px; line-height: norma= l; font-family: "Bradley Hand"; font-size-adjust: none; font-ke= rning: auto; font-variant-alternates: normal; font-variant-ligatures: nor= mal; font-variant-numeric: normal; font-variant-east-asian: normal; font-= variant-position: normal; font-feature-settings: normal; font-optical-siz= ing: auto; font-variation-settings: normal;=22><br></p></div><div><br></d= iv></div> <p class=3D=22gmail=5Fquote=22 style=3D=22color:=23000;=22>P=C3= =A5 17 augusti 2025 till 09:12:09, =46rancesco Chicchiricc=C3=B2 (<a href= =3D=22mailto:ilgrosso=40apache.org=22>ilgrosso=40apache.org</a>) skrev:</= p> <blockquote type=3D=22cite=22 class=3D=22gmail=5Fquote=22><span><div><= div></div><div>Hi Paul, <br>thank you for your answer. <br> <br>About sandbox, what do you think about =5B3=5D or =5B4=5D=3F Both see= ms to be quite active, license-compliant and available from Maven Central= . <br> <br>Also, do you have any example of ImportCustomizer / SecureASTCustomiz= er to start from=3F I have only found =5B5=5D so far. <br> <br>Regards. <br> <br>=5B3=5D https://github.com/dalet-oss/groovy-sandbox <br>=5B4=5D https://github.com/craftercms/groovy-sandbox <br>=5B5=5D https://github.com/jenkinsci/script-security-plugin/blob/mast= er/src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/Reje= ctASTTransformsCustomizer.java <br> <br>On 2025/08/16 21:31:36 Paul King wrote: <br><blockquote type=3D=22cite=22>Step 4 in your reference =5B2=5D is the= key. <br> <br>You can provide an ImportCustomizer and a SecureASTCustomizer to limi= t <br>imports and prohibit statements like =22System.exit()=22. As mentione= d in that <br>article, that doesn't stop folks potentially using reflection or othe= r <br>tricks to execute the exit() statement. You can start trying to lock = down <br>such statements too. It becomes increasingly tricky to block all of t= he <br>tricks without crippling what your users may legitimately want to exe= cute. <br>So, having a sandbox is the next step. <br> <br>Using the security manager with a policy file, also mentioned in that= <br>reference, has gone out of vogue and isn't supported in the latest JD= Ks. <br>You'd more typically use a VM these days and set up a machine where i= t <br>didn't matter if a script somehow managed to read the /etc/passwd fil= e (or <br>whatever). <br> <br>We have been meaning to document best practices for a sandbox environ= ment <br>but haven't found the cycles yet. We'd be super keen to work with you= to <br>write something up if you make progress. <br> <br>Cheers, Paul. <br> <br> <br>On Sat, Aug 16, 2025 at 5:13=E2=80=AFPM =46rancesco Chicchiricc=C3=B2= <ilgrosso=40apache.org> <br>wrote: <br> <br><blockquote type=3D=22cite=22>Hi team, <br>Syncope is offering the possibility to extend / customize the base <br>behavior on every deployment by allowing to provide custom implementa= tions <br>of a few Java interfaces; such implementations can be provided either= as <br>Java or Groovy classes =5B1=5D, with the latter being particularly at= tractive <br>as the machinery is set for runtime reload. <br> <br>I was wondering if there is any best-practice available to limit what= <br>could be done by Groovy classes (e.g. System.exit, spawning new proce= sses, <br>etc.). <br>I found =5B2=5D and a few other references which looks anyway either = old or <br>not for general purpose. <br> <br>Can you suggest something else=3F <br> <br>TIA <br>Regards. <br> <br>=5B1=5D <br>https://syncope.apache.org/docs/4.0/reference-guide.html=23implementa= tions <br>=5B2=5D <br>https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-= sandbox-ea39f80ee87 <br> <br>-- <br>=46rancesco Chicchiricc=C3=B2 <br> <br>Tirasa - Open Source Excellence <br>http://www.tirasa.net/ <br> <br>Member at The Apache Software =46oundation <br>Syncope, Cocoon, Olingo, CX=46, OpenJPA <br>https://about.me/ilgrosso <br> <br> <br></blockquote> <br></blockquote></div></div></span></blockquote></body></html> --68a191e8_625558ec_238a--