[Java] Class SecureASTCustomizer

 final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
             final SecureASTCustomizer secure = new SecureASTCustomizer()
             secure.with {
                 closuresAllowed = false
                 methodDefinitionAllowed = false

                 importsWhitelist = []
                 staticImportsWhitelist = []
                 staticStarImportsWhitelist = ['java.lang.Math'] // only java.lang.Math is allowed

                 tokensWhitelist = [
                         PLUS,
                         MINUS,
                         MULTIPLY,
                         DIVIDE,
                         MOD,
                         POWER,
                         PLUS_PLUS,
                         MINUS_MINUS,
                         COMPARE_EQUAL,
                         COMPARE_NOT_EQUAL,
                         COMPARE_LESS_THAN,
                         COMPARE_LESS_THAN_EQUAL,
                         COMPARE_GREATER_THAN,
                         COMPARE_GREATER_THAN_EQUAL,
                 ].asImmutable()

                 constantTypesClassesWhiteList = [
                         Integer,
                         Float,
                         Long,
                         Double,
                         BigDecimal,
                         Integer.TYPE,
                         Long.TYPE,
                         Float.TYPE,
                         Double.TYPE
                 ].asImmutable()

                 receiversClassesWhiteList = [
                         Math,
                         Integer,
                         Float,
                         Double,
                         Long,
                         BigDecimal
                 ].asImmutable()
             }
             CompilerConfiguration config = new CompilerConfiguration()
             config.addCompilationCustomizers(imports, secure)
             GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)
  

Constructor Detail

public SecureASTCustomizer()

Method Detail

public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)

public void addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)

@Override public void call(SourceUnit source, GeneratorContext context, ClassNode classNode)

public List<String> getConstantTypesBlackList()

public List<String> getConstantTypesWhiteList()

public List<Class<? extends Expression>> getExpressionsBlacklist()

public List<Class<? extends Expression>> getExpressionsWhitelist()

public List<String> getImportsBlacklist()

public List<String> getImportsWhitelist()

public List<String> getReceiversBlackList()

public List<String> getReceiversWhiteList()

public List<String> getStarImportsBlacklist()

public List<String> getStarImportsWhitelist()

public List<Class<? extends Statement>> getStatementsBlacklist()

public List<Class<? extends Statement>> getStatementsWhitelist()

public List<String> getStaticImportsBlacklist()

public List<String> getStaticImportsWhitelist()

public List<String> getStaticStarImportsBlacklist()

public List<String> getStaticStarImportsWhitelist()

public List<Integer> getTokensBlacklist()

public List<Integer> getTokensWhitelist()

public boolean isClosuresAllowed()

public boolean isIndirectImportCheckEnabled()

public boolean isMethodDefinitionAllowed()

public boolean isPackageAllowed()

public void setClosuresAllowed(boolean closuresAllowed)

public void setConstantTypesBlackList(List<String> constantTypesBlackList)

public void setConstantTypesClassesBlackList(List<Class> constantTypesBlackList)

An alternative way of setting constant types.

Parameters:

constantTypesBlackList - a list of classes.

public void setConstantTypesClassesWhiteList(List<Class> constantTypesWhiteList)

An alternative way of setting constant types.

Parameters:

constantTypesWhiteList - a list of classes.

public void setConstantTypesWhiteList(List<String> constantTypesWhiteList)

public void setExpressionsBlacklist(List<Class<? extends Expression>> expressionsBlacklist)

public void setExpressionsWhitelist(List<Class<? extends Expression>> expressionsWhitelist)

public void setImportsBlacklist(List<String> importsBlacklist)

public void setImportsWhitelist(List<String> importsWhitelist)

public void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)

Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.

Parameters:

indirectImportCheckEnabled - set to true to enable indirect checks

public void setMethodDefinitionAllowed(boolean methodDefinitionAllowed)

public void setPackageAllowed(boolean packageAllowed)

public void setReceiversBlackList(List<String> receiversBlackList)

Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be reletively simple to bypass any blacklist unless the receivers blacklist contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also blacklist MethodPointerExpression in the expressions blacklist for the receivers blacklist to function as a security check.

Parameters:

receiversBlackList - the list of refused classes, as fully qualified names

public void setReceiversClassesBlackList(List<Class> receiversBlacklist)

An alternative way of setting receiver classes.

Parameters:

receiversBlacklist - a list of classes.

public void setReceiversClassesWhiteList(List<Class> receiversWhitelist)

An alternative way of setting receiver classes.

Parameters:

receiversWhitelist - a list of classes.

public void setReceiversWhiteList(List<String> receiversWhiteList)

Sets the list of classes which may accept method calls.

Parameters:

receiversWhiteList - the list of accepted classes, as fully qualified names

public void setStarImportsBlacklist(List<String> starImportsBlacklist)

public void setStarImportsWhitelist(List<String> starImportsWhitelist)

public void setStatementsBlacklist(List<Class<? extends Statement>> statementsBlacklist)

public void setStatementsWhitelist(List<Class<? extends Statement>> statementsWhitelist)

public void setStaticImportsBlacklist(List<String> staticImportsBlacklist)

public void setStaticImportsWhitelist(List<String> staticImportsWhitelist)

public void setStaticStarImportsBlacklist(List<String> staticStarImportsBlacklist)

public void setStaticStarImportsWhitelist(List<String> staticStarImportsWhitelist)

public void setTokensBlacklist(List<Integer> tokensBlacklist)

Sets the list of tokens which are blacklisted.

Parameters:

tokensBlacklist - the tokens. The values of the tokens must be those of Types

public void setTokensWhitelist(List<Integer> tokensWhitelist)

Sets the list of tokens which are whitelisted.

Parameters:

tokensWhitelist - the tokens. The values of the tokens must be those of Types