[
https://issues.apache.org/jira/browse/GROOVY-12374?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Paul King updated GROOVY-12374:
-------------------------------
Description:
h2. Problem
The launcher scripts ({{startGroovy}} / {{startGroovy.bat}}) always append the
current directory ({{.}}) to the classpath, in every branch -- including when
an explicit {{-cp}}/{{-classpath}} option or the {{CLASSPATH}} environment
variable is supplied:
{code:bash}
if [ -n "$CP" ] ; then
CP="$CP":.
elif [ -n "$CLASSPATH" ] ; then
CP="$CLASSPATH":.
else
CP=.
fi
{code}
This has two problems:
* It diverges from the {{java}} interpreter, which does *not* add {{.}} when a
classpath is given ({{java -cp foo Main}} uses only {{foo}}). It also
contradicts the launcher's own comment, which claims {{-cp}} behaves "the same
as the java interpreter".
* It places the current working directory on the classpath of *every* Groovy
command, so running a tool from a directory containing a stray {{.class}} can
load it -- an untrusted-search-path footgun (CWE-427).
h2. Change
An explicit {{-cp}}/{{-classpath}} option, or the {{CLASSPATH}} environment
variable, is now honoured as-is. Only a bare invocation with no classpath given
falls back to the current directory, matching {{java}}/{{javac}}.
Applied uniformly across both launchers ({{startGroovy}} and
{{startGroovy.bat}}), and therefore to {{groovy}}, {{groovyc}}, {{groovysh}},
{{groovyConsole}}, and the rest.
h2. Compatibility
* The common "cd into a project and run" workflow is *unchanged*: a bare
{{groovy MyScript.groovy}} still puts the current directory on the classpath,
so sibling scripts, classes and resources resolve as before.
* The only behaviour change: {{groovy -cp lib.jar MyScript}} no longer silently
adds {{.}} as well. Anyone relying on that must include it explicitly -- {{-cp
lib.jar:.}} (Unix) or {{-cp lib.jar;.}} (Windows) -- exactly as {{java}} has
always required.
Being a behaviour change to the launchers, this is targeted at 6.0. Documented
in the command-line tools user guide.
> Launchers: match java classpath semantics — no implicit . when -cp is set
> -------------------------------------------------------------------------
>
> Key: GROOVY-12374
> URL: https://issues.apache.org/jira/browse/GROOVY-12374
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Priority: Major
>
> h2. Problem
> The launcher scripts ({{startGroovy}} / {{startGroovy.bat}}) always append
> the current directory ({{.}}) to the classpath, in every branch -- including
> when an explicit {{-cp}}/{{-classpath}} option or the {{CLASSPATH}}
> environment variable is supplied:
> {code:bash}
> if [ -n "$CP" ] ; then
> CP="$CP":.
> elif [ -n "$CLASSPATH" ] ; then
> CP="$CLASSPATH":.
> else
> CP=.
> fi
> {code}
> This has two problems:
> * It diverges from the {{java}} interpreter, which does *not* add {{.}} when
> a classpath is given ({{java -cp foo Main}} uses only {{foo}}). It also
> contradicts the launcher's own comment, which claims {{-cp}} behaves "the
> same as the java interpreter".
> * It places the current working directory on the classpath of *every* Groovy
> command, so running a tool from a directory containing a stray {{.class}} can
> load it -- an untrusted-search-path footgun (CWE-427).
> h2. Change
> An explicit {{-cp}}/{{-classpath}} option, or the {{CLASSPATH}} environment
> variable, is now honoured as-is. Only a bare invocation with no classpath
> given falls back to the current directory, matching {{java}}/{{javac}}.
> Applied uniformly across both launchers ({{startGroovy}} and
> {{startGroovy.bat}}), and therefore to {{groovy}}, {{groovyc}}, {{groovysh}},
> {{groovyConsole}}, and the rest.
> h2. Compatibility
> * The common "cd into a project and run" workflow is *unchanged*: a bare
> {{groovy MyScript.groovy}} still puts the current directory on the classpath,
> so sibling scripts, classes and resources resolve as before.
> * The only behaviour change: {{groovy -cp lib.jar MyScript}} no longer
> silently adds {{.}} as well. Anyone relying on that must include it
> explicitly -- {{-cp lib.jar:.}} (Unix) or {{-cp lib.jar;.}} (Windows) --
> exactly as {{java}} has always required.
> Being a behaviour change to the launchers, this is targeted at 6.0.
> Documented in the command-line tools user guide.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
