Merge pull request #199 from rudolfwalter/JENKINS-50843

Allow calling Closure elements of Maps as methods
jenkinsci · Apr 26, 2018 · 23fdbbb · 23fdbbb
2 parents d6b52e9 + b841fc0
commit 23fdbbb
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptor.java b/src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptor.java
@@ -25,6 +25,7 @@
 package org.jenkinsci.plugins.scriptsecurity.sandbox.groovy;
 
 import com.google.common.collect.ImmutableSet;
+import groovy.lang.Closure;
 import groovy.lang.GroovyRuntimeException;
 import groovy.lang.MetaMethod;
 import groovy.lang.MissingMethodException;
@@ -35,6 +36,7 @@
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.util.Arrays;
+import java.util.Map;
 import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
@@ -114,6 +116,14 @@ final class SandboxInterceptor extends GroovyInterceptor {
                 throw StaticWhitelist.rejectStaticMethod(foundDgmMethod);
             }
 
+            // allow calling Closure elements of Maps as methods
+            if (receiver instanceof Map) {
+                Object element = onMethodCall(invoker, receiver, "get", method);
+                if (element instanceof Closure) {
+                    return onMethodCall(invoker, element, "call", args);
+                }
+            }
+
             // if no matching method, look for catchAll "invokeMethod"
             try {
                 receiver.getClass().getMethod("invokeMethod", String.class, Object.class);

diff --git a/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java b/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java
@@ -1080,4 +1080,13 @@ public void checkedGetPropertyOnCollection() throws Exception {
                 "def l = [new " + snb + "('a'), new " + snb +"('b'), new " + snb + "('c')]\n" +
                         "return l.other\n");
     }
+
+    @Issue("JENKINS-50843")
+    @Test
+    public void callClosureElementOfMapAsMethod() throws Exception {
+        assertEvaluate(new GenericWhitelist(), "hello", "def m = [ f: {return 'hello'} ]; m.f()");
+        assertEvaluate(new GenericWhitelist(), 15, "def m = [ f: {a -> return a*3} ]; m.f(5)");
+        assertEvaluate(new GenericWhitelist(), "a=hello,b=10", "def m = [ f: {a,b -> return \"a=${a},b=${b}\"} ]; m.f('hello',10)");
+        assertEvaluate(new GenericWhitelist(), 2, "def m = [ f: {it.size()} ]; m.f(foo:0, bar:1)");
+    }
 }