Skip to content

Commit

Permalink
[FIXED JENKINS-31234] Groovy allows Singleton.instance as an alias fo…
Browse files Browse the repository at this point in the history 
…r Singleton.getInstance().
  • Loading branch information
@jglick
jglick committed Oct 28, 2015
1 parent e61d093 commit c3212ef
Show file tree
Hide file tree
Showing 3 changed files with 59 additions and 16 deletions.
48 changes: 32 additions & 16 deletions src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptor.java
View file
Expand Up @@ -113,24 +113,30 @@ final class SandboxInterceptor extends GroovyInterceptor {
return super.onSetProperty(invoker, receiver, property, value);
}
// https://github.com/kohsuke/groovy-sandbox/issues/7 need to explicitly check for getters and setters:
Object[] args = new Object[] {value};
Method m = GroovyCallSiteSelector.method(receiver, "set" + Functions.capitalize(property), args);
if (m != null && whitelist.permitsMethod(m, receiver, args)) {
Object[] args1 = new Object[] {value};
String setter = "set" + Functions.capitalize(property);
Method m = GroovyCallSiteSelector.method(receiver, setter, args1);
if (m != null && whitelist.permitsMethod(m, receiver, args1)) {
return super.onSetProperty(invoker, receiver, property, value);
}
args = new Object[] {property, value};
Method m2 = GroovyCallSiteSelector.method(receiver, "setProperty", args);
if (m2 != null && whitelist.permitsMethod(m2, receiver, args)) {
Object[] args2 = new Object[] {property, value};
Method m2 = GroovyCallSiteSelector.method(receiver, "setProperty", args2);
if (m2 != null && whitelist.permitsMethod(m2, receiver, args2)) {
return super.onSetProperty(invoker, receiver, property, value);
}
Field f2 = null;
Method m3 = null;
if (receiver instanceof Class) {
f2 = GroovyCallSiteSelector.staticField((Class) receiver, property);
if (f2 != null && whitelist.permitsStaticFieldSet(f2, value)) {
return super.onSetProperty(invoker, receiver, property, value);
}
m3 = GroovyCallSiteSelector.staticMethod((Class) receiver, setter, args1);
if (m3 != null && whitelist.permitsStaticMethod(m3, args1)) {
return super.onSetProperty(invoker, receiver, property, value);
}
}
throw rejectField(f, m, m2, f2, receiver, property);
throw rejectField(f, m, m2, f2, m3, receiver, property);
}

@edu.umd.cs.findbugs.annotations.SuppressWarnings("NP_LOAD_OF_KNOWN_NULL_VALUE")
Expand All @@ -151,35 +157,45 @@ final class SandboxInterceptor extends GroovyInterceptor {
if (f != null && whitelist.permitsFieldGet(f, receiver)) {
return super.onGetProperty(invoker, receiver, property);
}
Object[] args = new Object[] {};
Method m = GroovyCallSiteSelector.method(receiver, "get" + Functions.capitalize(property), args);
if (m != null && whitelist.permitsMethod(m, receiver, args)) {
Object[] args0 = new Object[] {};
String getter = "get" + Functions.capitalize(property);
Method m = GroovyCallSiteSelector.method(receiver, getter, args0);
if (m != null && whitelist.permitsMethod(m, receiver, args0)) {
return super.onGetProperty(invoker, receiver, property);
}
args = new Object[] {property};
Method m2 = GroovyCallSiteSelector.method(receiver, "getProperty", args);
if (m2 != null && whitelist.permitsMethod(m2, receiver, args)) {
Object[] args1 = new Object[] {property};
Method m2 = GroovyCallSiteSelector.method(receiver, "getProperty", args1);
if (m2 != null && whitelist.permitsMethod(m2, receiver, args1)) {
return super.onGetProperty(invoker, receiver, property);
}
Field f2 = null;
Method m3 = null;
if (receiver instanceof Class) {
f2 = GroovyCallSiteSelector.staticField((Class) receiver, property);
if (f2 != null && whitelist.permitsStaticFieldGet(f2)) {
return super.onGetProperty(invoker, receiver, property);
}
m3 = GroovyCallSiteSelector.staticMethod((Class) receiver, getter, args0);
if (m3 != null && whitelist.permitsStaticMethod(m3, args0)) {
return super.onGetProperty(invoker, receiver, property);
}
}
if (mpe != null) {
throw mpe;
}
throw rejectField(f, m, m2, f2, receiver, property);
throw rejectField(f, m, m2, f2, m3, receiver, property);
}

private static RejectedAccessException rejectField(Field f, Method m, Method m2, Field f2, Object receiver, String property) {
private static RejectedAccessException rejectField(Field f, Method m, Method m2, Field f2, Method m3, Object receiver, String property) {
if (f == null) {
if (m == null) {
if (m2 == null) {
if (f2 == null) {
return new RejectedAccessException("unclassified field " + EnumeratingWhitelist.getName(receiver.getClass()) + " " + property);
if (m3 == null) {
return new RejectedAccessException("unclassified field " + EnumeratingWhitelist.getName(receiver.getClass()) + " " + property);
} else {
return StaticWhitelist.rejectStaticMethod(m3);
}
} else {
return StaticWhitelist.rejectStaticField(f2);
}
Expand Down
21 changes: 21 additions & 0 deletions src/main/resources/org/jenkinsci/plugins/scriptsecurity/sandbox/whitelists/generic-whitelist
View file
Expand Up @@ -28,6 +28,27 @@ method java.lang.String replace java.lang.CharSequence java.lang.CharSequence
method java.util.Collection contains java.lang.Object
method java.util.concurrent.Callable call
new java.io.StringReader java.lang.String
staticMethod java.util.Calendar getInstance
method java.util.Calendar get int
staticField java.util.Calendar ERA
staticField java.util.Calendar YEAR
staticField java.util.Calendar MONTH
staticField java.util.Calendar WEEK_OF_YEAR
staticField java.util.Calendar WEEK_OF_MONTH
staticField java.util.Calendar DATE
staticField java.util.Calendar DAY_OF_MONTH
staticField java.util.Calendar DAY_OF_YEAR
staticField java.util.Calendar DAY_OF_WEEK
staticField java.util.Calendar DAY_OF_WEEK_IN_MONTH
staticField java.util.Calendar AM_PM
staticField java.util.Calendar HOUR
staticField java.util.Calendar HOUR_OF_DAY
staticField java.util.Calendar MINUTE
staticField java.util.Calendar SECOND
staticField java.util.Calendar MILLISECOND
staticField java.util.Calendar ZONE_OFFSET
staticField java.util.Calendar DST_OFFSET
staticField java.util.Calendar FIELD_COUNT

# Groovy:
method groovy.lang.Script getBinding
Expand Down
6 changes: 6 additions & 0 deletions ...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java
View file
Expand Up @@ -485,6 +485,12 @@ public Object invokeMethod(String name, Object args) {
assertEvaluate(new GenericWhitelist(), null, script);
}

@Issue("JENKINS-31234")
@Test public void calendarGetInstance() throws Exception {
assertEvaluate(new GenericWhitelist(), true, "Calendar.getInstance().get(Calendar.DAY_OF_MONTH) < 32");
assertEvaluate(new GenericWhitelist(), true, "Calendar.instance.get(Calendar.DAY_OF_MONTH) < 32");
}

private static void assertEvaluate(Whitelist whitelist, final Object expected, final String script) {
final GroovyShell shell = new GroovyShell(GroovySandbox.createSecureCompilerConfiguration());
Object actual = GroovySandbox.run(shell.parse(script), whitelist);
Expand Down

0 comments on commit c3212ef

Please sign in to comment.