Re: Best practice to limit the capability of Groovy classes
Paul King <[email protected]> Sat, 30 Aug 2025 20:03:02 +1000
| Newsgroups | gmane.comp.lang.groovy.user |
|---|---|
| Message-ID | <CAMbkE7R3hssaK2xNunCBmP-1rvLH4eYqYxpe9WxgBOf1q=9+GA@mail.gmail.com> |
--000000000000210d51063d923fc5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks so much for providing those references! If you or anyone in your team would be willing to help write a blog post or some Groovy documentation about where you got to and/or pointers for others wanting to do something similar, do let us know. Cheers, Paul. On Sat, Aug 30, 2025 at 3:51=E2=80=AFPM Francesco Chicchiricc=C3=B2 <ilgros= [email protected]> wrote: > FYI we have created > > https://github.com/Tirasa/groovy-security-sandbox > > by forking > > https://github.com/jenkinsci/groovy-sandbox > > with some goodies from the sibling fork > > https://github.com/craftercms/groovy-sandbox > > and some polish. > > The library was applied to Syncope in > > > https://github.com/apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b= 93f02a16 > > and ConnId (supporting framework for provisioning) in > > > https://github.com/Tirasa/ConnId/commit/bc4f4a3b3a424c2f1431fafe0a507f4a5= ff17ba7 > > Regards. > > On 2025/08/17 07:12:09 Francesco Chicchiricc=C3=B2 wrote: > > Hi Paul, > > thank you for your answer. > > > > About sandbox, what do you think about [3] or [4]? Both seems to be > quite active, license-compliant and available from Maven Central. > > > > Also, do you have any example of ImportCustomizer / SecureASTCustomizer > to start from? I have only found [5] so far. > > > > Regards. > > > > [3] https://github.com/dalet-oss/groovy-sandbox > > [4] https://github.com/craftercms/groovy-sandbox > > [5] > https://github.com/jenkinsci/script-security-plugin/blob/master/src/main/= java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/RejectASTTransform= sCustomizer.java > > > > On 2025/08/16 21:31:36 Paul King wrote: > > > Step 4 in your reference [2] is the key. > > > > > > You can provide an ImportCustomizer and a SecureASTCustomizer to limi= t > > > imports and prohibit statements like "System.exit()". As mentioned in > that > > > article, that doesn't stop folks potentially using reflection or othe= r > > > tricks to execute the exit() statement. You can start trying to lock > down > > > such statements too. It becomes increasingly tricky to block all of t= he > > > tricks without crippling what your users may legitimately want to > execute. > > > So, having a sandbox is the next step. > > > > > > Using the security manager with a policy file, also mentioned in that > > > reference, has gone out of vogue and isn't supported in the latest > JDKs. > > > You'd more typically use a VM these days and set up a machine where i= t > > > didn't matter if a script somehow managed to read the /etc/passwd fil= e > (or > > > whatever). > > > > > > We have been meaning to document best practices for a sandbox > environment > > > but haven't found the cycles yet. We'd be super keen to work with you > to > > > write something up if you make progress. > > > > > > Cheers, Paul. > > > > > > > > > On Sat, Aug 16, 2025 at 5:13=E2=80=AFPM Francesco Chicchiricc=C3=B2 < > [email protected]> > > > wrote: > > > > > > > Hi team, > > > > Syncope is offering the possibility to extend / customize the base > > > > behavior on every deployment by allowing to provide custom > implementations > > > > of a few Java interfaces; such implementations can be provided > either as > > > > Java or Groovy classes [1], with the latter being particularly > attractive > > > > as the machinery is set for runtime reload. > > > > > > > > I was wondering if there is any best-practice available to limit wh= at > > > > could be done by Groovy classes (e.g. System.exit, spawning new > processes, > > > > etc.). > > > > I found [2] and a few other references which looks anyway either ol= d > or > > > > not for general purpose. > > > > > > > > Can you suggest something else? > > > > > > > > TIA > > > > Regards. > > > > > > > > [1] > > > > > https://syncope.apache.org/docs/4.0/reference-guide.html#implementations > > > > [2] > > > > > https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-sand= box-ea39f80ee87 > > > > > > > > -- > > > > Francesco Chicchiricc=C3=B2 > > > > > > > > Tirasa - Open Source Excellence > > > > http://www.tirasa.net/ > > > > > > > > Member at The Apache Software Foundation > > > > Syncope, Cocoon, Olingo, CXF, OpenJPA > > > > https://about.me/ilgrosso > > > > > > > > > > > > > > --000000000000210d51063d923fc5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks so much for providing those references!<div><br></d= iv><div>If you or anyone in your team would be willing to help write a blog= post or some Groovy documentation about where you got to and/or pointers f= or others wanting to do something similar, do let us know.</div><div><br></= div><div>Cheers, Paul.</div><div><br></div></div><br><div class=3D"gmail_qu= ote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Au= g 30, 2025 at 3:51=E2=80=AFPM Francesco Chicchiricc=C3=B2 <<a href=3D"ma= ilto:[email protected]">[email protected]</a>> wrote:<br></div><bloc= kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:= 1px solid rgb(204,204,204);padding-left:1ex">FYI we have created<br> <br> <a href=3D"https://github.com/Tirasa/groovy-security-sandbox" rel=3D"norefe= rrer" target=3D"_blank">https://github.com/Tirasa/groovy-security-sandbox</= a><br> <br> by forking <br> <br> <a href=3D"https://github.com/jenkinsci/groovy-sandbox" rel=3D"noreferrer" = target=3D"_blank">https://github.com/jenkinsci/groovy-sandbox</a><br> <br> with some goodies from the sibling fork<br> <br> <a href=3D"https://github.com/craftercms/groovy-sandbox" rel=3D"noreferrer"= target=3D"_blank">https://github.com/craftercms/groovy-sandbox</a><br> <br> and some polish.<br> <br> The library was applied to Syncope in<br> <br> <a href=3D"https://github.com/apache/syncope/commit/8b08c4d5785599a0e38830d= cff89738b93f02a16" rel=3D"noreferrer" target=3D"_blank">https://github.com/= apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b93f02a16</a><br> <br> and ConnId (supporting framework for provisioning) in<br> <br> <a href=3D"https://github.com/Tirasa/ConnId/commit/bc4f4a3b3a424c2f1431fafe= 0a507f4a5ff17ba7" rel=3D"noreferrer" target=3D"_blank">https://github.com/T= irasa/ConnId/commit/bc4f4a3b3a424c2f1431fafe0a507f4a5ff17ba7</a><br> <br> Regards.<br> <br> On 2025/08/17 07:12:09 Francesco Chicchiricc=C3=B2 wrote:<br> > Hi Paul,<br> > thank you for your answer.<br> > <br> > About sandbox, what do you think about [3] or [4]? Both seems to be qu= ite active, license-compliant and available from Maven Central.<br> > <br> > Also, do you have any example of ImportCustomizer / SecureASTCustomize= r to start from? I have only found [5] so far.<br> > <br> > Regards.<br> > <br> > [3] <a href=3D"https://github.com/dalet-oss/groovy-sandbox" rel=3D"nor= eferrer" target=3D"_blank">https://github.com/dalet-oss/groovy-sandbox</a><= br> > [4] <a href=3D"https://github.com/craftercms/groovy-sandbox" rel=3D"no= referrer" target=3D"_blank">https://github.com/craftercms/groovy-sandbox</a= ><br> > [5] <a href=3D"https://github.com/jenkinsci/script-security-plugin/blo= b/master/src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/= RejectASTTransformsCustomizer.java" rel=3D"noreferrer" target=3D"_blank">ht= tps://github.com/jenkinsci/script-security-plugin/blob/master/src/main/java= /org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/RejectASTTransformsCus= tomizer.java</a><br> > <br> > On 2025/08/16 21:31:36 Paul King wrote:<br> > > Step 4 in your reference [2] is the key.<br> > > <br> > > You can provide an ImportCustomizer and a SecureASTCustomizer to = limit<br> > > imports and prohibit statements like "System.exit()". A= s mentioned in that<br> > > article, that doesn't stop folks potentially using reflection= or other<br> > > tricks to execute the exit() statement. You can start trying to l= ock down<br> > > such statements too. It becomes increasingly tricky to block all = of the<br> > > tricks without crippling what your users may legitimately want to= execute.<br> > > So, having a sandbox is the next step.<br> > > <br> > > Using the security manager with a policy file, also mentioned in = that<br> > > reference, has gone out of vogue and isn't supported in the l= atest JDKs.<br> > > You'd more typically use a VM these days and set up a machine= where it<br> > > didn't matter if a script somehow managed to read the /etc/pa= sswd file (or<br> > > whatever).<br> > > <br> > > We have been meaning to document best practices for a sandbox env= ironment<br> > > but haven't found the cycles yet. We'd be super keen to w= ork with you to<br> > > write something up if you make progress.<br> > > <br> > > Cheers, Paul.<br> > > <br> > > <br> > > On Sat, Aug 16, 2025 at 5:13=E2=80=AFPM Francesco Chicchiricc=C3= =B2 <<a href=3D"mailto:[email protected]" target=3D"_blank">ilgrosso@a= pache.org</a>><br> > > wrote:<br> > > <br> > > > Hi team,<br> > > > Syncope is offering the possibility to extend / customize th= e base<br> > > > behavior on every deployment by allowing to provide custom i= mplementations<br> > > > of a few Java interfaces; such implementations can be provid= ed either as<br> > > > Java or Groovy classes [1], with the latter being particular= ly attractive<br> > > > as the machinery is set for runtime reload.<br> > > ><br> > > > I was wondering if there is any best-practice available to l= imit what<br> > > > could be done by Groovy classes (e.g. System.exit, spawning = new processes,<br> > > > etc.).<br> > > > I found [2] and a few other references which looks anyway ei= ther old or<br> > > > not for general purpose.<br> > > ><br> > > > Can you suggest something else?<br> > > ><br> > > > TIA<br> > > > Regards.<br> > > ><br> > > > [1]<br> > > > <a href=3D"https://syncope.apache.org/docs/4.0/reference-gui= de.html#implementations" rel=3D"noreferrer" target=3D"_blank">https://synco= pe.apache.org/docs/4.0/reference-guide.html#implementations</a><br> > > > [2]<br> > > > <a href=3D"https://levelup.gitconnected.com/secure-groovy-sc= ript-execution-in-a-sandbox-ea39f80ee87" rel=3D"noreferrer" target=3D"_blan= k">https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-san= dbox-ea39f80ee87</a><br> > > ><br> > > > --<br> > > > Francesco Chicchiricc=C3=B2<br> > > ><br> > > > Tirasa - Open Source Excellence<br> > > > <a href=3D"http://www.tirasa.net/" rel=3D"noreferrer" target= =3D"_blank">http://www.tirasa.net/</a><br> > > ><br> > > > Member at The Apache Software Foundation<br> > > > Syncope, Cocoon, Olingo, CXF, OpenJPA<br> > > > <a href=3D"https://about.me/ilgrosso" rel=3D"noreferrer" tar= get=3D"_blank">https://about.me/ilgrosso</a><br> > > ><br> > > ><br> > > <br> > <br> </blockquote></div> --000000000000210d51063d923fc5--