Merge pull request #139 from abayer/jenkins-46088

[JENKINS-46088] Verify removal of double transform of cast expression
jenkinsci · Aug 16, 2017 · 7a81a07 · 7a81a07
2 parents ea5ce36 + bd3a6ab
commit 7a81a07
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/pom.xml b/pom.xml
@@ -47,7 +47,7 @@
     <dependency>
       <groupId>org.kohsuke</groupId>
       <artifactId>groovy-sandbox</artifactId>
-      <version>1.13</version>
+      <version>1.14</version>
       <exclusions>
         <exclusion>
           <groupId>org.codehaus.groovy</groupId>

diff --git a/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java b/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java
@@ -848,4 +848,17 @@ public static void assertRejected(Whitelist whitelist, String expectedSignature,
         // control: trying to call an existing method that's not safe
         assertRejected(new GenericWhitelist(), "method java.lang.Class getClassLoader", "[].class.classLoader");
     }
+
+    @Issue("JENKINS-46088")
+    @Test
+    public void matcherTypeAssignment() throws Exception {
+        assertEvaluate(new GenericWhitelist(), "goodbye world", "def text = 'hello world'; java.util.regex.Matcher matcher = text =~ 'hello (.+)'; matcher ? \"goodbye ${matcher[0][1]}\" : 'fail'");
+    }
+
+    @Issue("JENKINS-46088")
+    @Test
+    public void rhsOfDeclarationTransformed() throws Exception {
+        assertRejected(new StaticWhitelist(), "staticMethod jenkins.model.Jenkins getInstance", "jenkins.model.Jenkins x = jenkins.model.Jenkins.getInstance()");
+    }
+
 }