[
https://issues.apache.org/jira/browse/GROOVY-12414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116323#comment-18116323
]
Nils Renaud commented on GROOVY-12414:
--------------------------------------
Thanks a lot for these pointers, yes I know about the SecureASTCustomizer and
read its "Despite its name, this customizer is not a sandbox and not a security
boundary" warning :)
I'll keep an eye on the discussion then, and wait for an outcome.
> Run groovy scripts in a sandboxed mode
> --------------------------------------
>
> Key: GROOVY-12414
> URL: https://issues.apache.org/jira/browse/GROOVY-12414
> Project: Groovy
> Issue Type: New Feature
> Reporter: Nils Renaud
> Priority: Minor
>
> I own an application extensible through Groovy scripts and 99% of my users
> only have to take an object as input, perform some transformations and return
> another object.
> They don't need to access the fileSystem, nor execute commands on the
> machine, nor access the network (for example).
>
> Would you consider adding an option to the `GroovyScriptEngine` to block such
> potentially dangerous calls ?
> We could even set a custom `FileSystem` implementation as the only accessible
> one from the script to introduce finer access rules.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
