SecureASTCustomizer (Groovy 6.0.0-alpha-2)

org.codehaus.groovy.control.customizers.SecureASTCustomizer

```
public class SecureASTCustomizer
extends CompilationCustomizer
```
This customizer allows securing source code by controlling what code constructs are permitted. This is typically done when using Groovy for its scripting or domain specific language (DSL) features. For example, if you only want to allow arithmetic operations in a groovy shell, you can configure this customizer to restrict package imports, method calls and so on.
Most of the security customization options found in this class work with either allowed or disallowed lists. This means that, for a single option, you can set an allowed list OR a disallowed list, but not both. You can mix allowed/disallowed strategies for different options. For example, you can have an allowed import list and a disallowed tokens list.
The recommended way of securing shells is to use allowed lists because it is guaranteed that future features of the Groovy language won't be accidentally allowed unless explicitly added to the allowed list. Using disallowed lists, you can limit the features of the language constructs supported by your shell by opting out, but new language features are then implicitly also available and this may not be desirable. The implication is that you might need to update your configuration with each new release.
If neither an allowed list nor a disallowed list is set, then everything is permitted.
Combinations of import and star import constraints are authorized as long as you use the same type of list for both. For example, you may use an import allowed list and a star import allowed list together, but you cannot use an import allowed list with a star import disallowed list. Static imports are handled separately, meaning that disallowing an import does not prevent from allowing a static import.
Eventually, if the features provided here are not sufficient, you may implement custom AST filtering handlers, either implementing the StatementChecker interface or ExpressionChecker interface then register your handlers thanks to the addExpressionCheckers(ExpressionChecker...) and addStatementCheckers(StatementChecker...) methods.
Here is an example of usage. We will create a groovy classloader which only supports arithmetic operations and imports the java.lang.Math classes by default.
```
 final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
 final SecureASTCustomizer secure = new SecureASTCustomizer()
 secure.with {
     closuresAllowed = false
     methodDefinitionAllowed = false

     allowedImports = []
     allowedStaticImports = []
     allowedStaticStarImports = ['java.lang.Math'] // only java.lang.Math is allowed

     allowedTokens = [
             PLUS,
             MINUS,
             MULTIPLY,
             DIVIDE,
             REMAINDER,
             POWER,
             PLUS_PLUS,
             MINUS_MINUS,
             COMPARE_EQUAL,
             COMPARE_NOT_EQUAL,
             COMPARE_LESS_THAN,
             COMPARE_LESS_THAN_EQUAL,
             COMPARE_GREATER_THAN,
             COMPARE_GREATER_THAN_EQUAL,
     ].asImmutable()

     allowedConstantTypesClasses = [
             Integer,
             Float,
             Long,
             Double,
             BigDecimal,
             Integer.TYPE,
             Long.TYPE,
             Float.TYPE,
             Double.TYPE
     ].asImmutable()

     allowedReceiversClasses = [
             Math,
             Integer,
             Float,
             Double,
             Long,
             BigDecimal
     ].asImmutable()
 }
 CompilerConfiguration config = new CompilerConfiguration()
 config.addCompilationCustomizers(imports, secure)
 GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)
  
```
Note: SecureASTCustomizer allows you to lock down the grammar of scripts but by itself isn't intended to be the complete solution of all security issues when running scripts on the JVM. You might also want to consider setting the groovy.grape.enable System property to false, augmenting use of the customizer with additional techniques, and following standard security principles for JVM applications. Accordingly, the Apache Groovy threat model treats this customizer as a hardening aid rather than a security boundary (see its "security properties the project does NOT provide" section): a report that merely demonstrates a bypass is by design, not a vulnerability.
For more information, please read:
Improved sandboxing of Groovy scripts
Oracle's Secure Coding Guidelines
10 Java security best practices
Thirteen rules for developing secure Java applications
12 Java Security Best Practices

Since:: 1.8.0

Nested Class Summary

Nested classes
Modifiers	Name	Description
`interface`	`SecureASTCustomizer.ExpressionChecker`	This interface allows the user to provide a custom expression checker if the dis/allowed expression lists are not sufficient
`protected class`	`SecureASTCustomizer.SecuringCodeVisitor`	This visitor directly implements the GroovyCodeVisitor interface instead of using the CodeVisitorSupport class to make sure that future features of the language gets managed by this visitor.
`interface`	`SecureASTCustomizer.StatementChecker`	This interface allows the user to provide a custom statement checker if the dis/allowed statement lists are not sufficient

Constructor Summary

Constructors
Constructor and description
`SecureASTCustomizer()` Creates a secure AST customizer that runs during canonicalization.

Methods Summary

Methods
Type Params	Return Type	Name and description
	`public void`	`addExpressionCheckers(SecureASTCustomizer.ExpressionChecker checkers)` Adds expression checkers consulted in addition to the allow/disallow lists.
	`public void`	`addStatementCheckers(SecureASTCustomizer.StatementChecker checkers)` Adds statement checkers consulted in addition to the allow/disallow lists.
	`protected void`	`assertImportIsAllowed(String className)` Verifies that a regular import is allowed by the current configuration.
	`protected void`	`assertStarImportIsAllowed(String packageName)` Verifies that a star import is allowed by the current configuration.
	`protected void`	`assertStaticImportIsAllowed(String member, String className)` Verifies that a static import is allowed by the current configuration.
	`public void`	`call(SourceUnit source, GeneratorContext context, ClassNode classNode)` Verifies the configured security rules against the current source unit and class.
	`protected void`	`checkMethodDefinitionAllowed(ClassNode owner)` Ensures the supplied class does not declare methods when such definitions are forbidden.
	`protected GroovyCodeVisitor`	`createGroovyCodeVisitor()` Creates the visitor that enforces statement and expression restrictions.
	`protected static List<MethodNode>`	`filterMethods(ClassNode owner)` Returns the non-synthetic methods declared directly by the supplied class.
	`public List<String>`	`getAllowedConstantTypes()` Returns the list of allowed constant or variable types.
	`public List<Class<? extends Expression>>`	`getAllowedExpressions()` Returns the list of allowed expression node types.
	`public List<String>`	`getAllowedImports()` Returns the list of explicitly allowed imports.
	`public List<String>`	`getAllowedReceivers()` Returns the list of receiver types on which calls are allowed.
	`public List<String>`	`getAllowedStarImports()` Returns the list of allowed star imports.
	`public List<Class<? extends Statement>>`	`getAllowedStatements()` Returns the list of allowed statement node types.
	`public List<String>`	`getAllowedStaticImports()` Returns the list of allowed static imports.
	`public List<String>`	`getAllowedStaticStarImports()` Returns the list of allowed static star imports.
	`public List<Integer>`	`getAllowedTokens()` Returns the list of allowed token types.
	`public List<String>`	`getConstantTypesBlackList()` Legacy alias for getDisallowedConstantTypes()
	`public List<String>`	`getConstantTypesWhiteList()` Legacy alias for getAllowedStatements()
	`public List<String>`	`getDisallowedConstantTypes()` Returns the list of disallowed constant or variable types.
	`public List<Class<? extends Expression>>`	`getDisallowedExpressions()` Returns the list of disallowed expression node types.
	`public List<String>`	`getDisallowedImports()` Returns the list of explicitly disallowed imports.
	`public List<String>`	`getDisallowedReceivers()` Returns the list of receiver types on which calls are disallowed.
	`public List<String>`	`getDisallowedStarImports()` Returns the list of disallowed star imports.
	`public List<Class<? extends Statement>>`	`getDisallowedStatements()` Returns the list of disallowed statement node types.
	`public List<String>`	`getDisallowedStaticImports()` Returns the list of disallowed static imports.
	`public List<String>`	`getDisallowedStaticStarImports()` Returns the list of disallowed static star imports.
	`public List<Integer>`	`getDisallowedTokens()` Returns the list of disallowed token types.
	`public List<Class<? extends Expression>>`	`getExpressionsBlacklist()` Legacy alias for getDisallowedExpressions()
	`public List<Class<? extends Expression>>`	`getExpressionsWhitelist()` Legacy alias for getAllowedExpressions()
	`public List<String>`	`getImportsBlacklist()` Legacy alias for getDisallowedImports()
	`public List<String>`	`getImportsWhitelist()` Legacy alias for getAllowedImports()
	`public List<String>`	`getReceiversBlackList()` Legacy alias for getDisallowedReceivers()
	`public List<String>`	`getReceiversWhiteList()` Legacy alias for getAllowedReceivers()
	`public List<String>`	`getStarImportsBlacklist()` Legacy alias for getDisallowedStarImports()
	`public List<String>`	`getStarImportsWhitelist()` Legacy alias for getAllowedStarImports()
	`public List<Class<? extends Statement>>`	`getStatementsBlacklist()` Legacy alias for getDisallowedStatements()
	`public List<Class<? extends Statement>>`	`getStatementsWhitelist()` Legacy alias for getAllowedStatements()
	`public List<String>`	`getStaticImportsBlacklist()` Legacy alias for getDisallowedStaticImports()
	`public List<String>`	`getStaticImportsWhitelist()` Legacy alias for getAllowedStaticImports()
	`public List<String>`	`getStaticStarImportsBlacklist()` Legacy alias for getDisallowedStaticStarImports()
	`public List<String>`	`getStaticStarImportsWhitelist()` Legacy alias for getAllowedStaticStarImports()
	`public List<Integer>`	`getTokensBlacklist()` Legacy alias for getDisallowedTokens()
	`public List<Integer>`	`getTokensWhitelist()` Legacy alias for getAllowedTokens()
	`public boolean`	`isClosuresAllowed()` Indicates whether closures are allowed.
	`public boolean`	`isIndirectImportCheckEnabled()` Indicates whether indirect import checks are enabled.
	`public boolean`	`isMethodDefinitionAllowed()` Indicates whether explicit method definitions are allowed.
	`public boolean`	`isPackageAllowed()` Indicates whether package declarations are allowed.
	`public void`	`setAllowedConstantTypes(List<String> allowedConstantTypes)` Sets the list of allowed constant or variable types.
	`public void`	`setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)` An alternative way of setting constant types.
	`public void`	`setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)` Sets the list of allowed expression node types.
	`public void`	`setAllowedImports(List<String> allowedImports)` Sets the list of explicitly allowed imports.
	`public void`	`setAllowedReceivers(List<String> allowedReceivers)` Sets the list of classes which may accept method calls.
	`public void`	`setAllowedReceiversClasses(List<Class> allowedReceivers)` An alternative way of setting receiver classes.
	`public void`	`setAllowedStarImports(List<String> allowedStarImports)` Sets the list of allowed star imports.
	`public void`	`setAllowedStatements(List<Class<? extends Statement>> allowedStatements)` Sets the list of allowed statement node types.
	`public void`	`setAllowedStaticImports(List<String> allowedStaticImports)` Sets the list of allowed static imports.
	`public void`	`setAllowedStaticStarImports(List<String> allowedStaticStarImports)` Sets the list of allowed static star imports.
	`public void`	`setAllowedTokens(List<Integer> allowedTokens)` Sets the list of tokens which are permitted.
	`public void`	`setClosuresAllowed(boolean closuresAllowed)` Sets whether closures are allowed.
	`public void`	`setConstantTypesBlackList(List<String> constantTypesBlackList)` Sets the list of disallowed constant or variable types.
	`public void`	`setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)` Legacy alias for setDisallowedConstantTypesClasses(List)
	`public void`	`setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)` Legacy alias for setAllowedConstantTypesClasses(List)
	`public void`	`setConstantTypesWhiteList(List<String> allowedConstantTypes)` Legacy alias for setAllowedConstantTypes(List)
	`public void`	`setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)` An alternative way of setting constant types.
	`public void`	`setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)` Sets the list of disallowed expression node types.
	`public void`	`setDisallowedImports(List<String> disallowedImports)` Sets the list of explicitly disallowed imports.
	`public void`	`setDisallowedReceivers(List<String> disallowedReceivers)` Sets the list of classes which deny method calls.
	`public void`	`setDisallowedReceiversClasses(List<Class> disallowedReceivers)` An alternative way of setting receiver classes.
	`public void`	`setDisallowedStarImports(List<String> disallowedStarImports)` Sets the list of disallowed star imports.
	`public void`	`setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)` Sets the list of disallowed statement node types.
	`public void`	`setDisallowedStaticImports(List<String> disallowedStaticImports)` Sets the list of disallowed static imports.
	`public void`	`setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)` Sets the list of disallowed static star imports.
	`public void`	`setDisallowedTokens(List<Integer> disallowedTokens)` Sets the list of tokens which are not permitted.
	`public void`	`setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)` Legacy alias for setDisallowedExpressions(List)
	`public void`	`setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)` Legacy alias for setAllowedExpressions(List)
	`public void`	`setImportsBlacklist(List<String> disallowedImports)` Legacy alias for setDisallowedImports(List)
	`public void`	`setImportsWhitelist(List<String> allowedImports)` Legacy alias for setAllowedImports(List)
	`public void`	`setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)` Set this option to true if you want your import rules to be checked against every class node.
	`public void`	`setMethodDefinitionAllowed(boolean methodDefinitionAllowed)` Sets whether explicit method definitions are allowed.
	`public void`	`setPackageAllowed(boolean packageAllowed)` Sets whether package declarations are allowed.
	`public void`	`setReceiversBlackList(List<String> disallowedReceivers)` Legacy alias for setDisallowedReceivers(List)
	`public void`	`setReceiversClassesBlackList(List<Class> disallowedReceivers)` Legacy alias for setDisallowedReceiversClasses(List).
	`public void`	`setReceiversClassesWhiteList(List<Class> allowedReceivers)` Legacy alias for setAllowedReceiversClasses(List)
	`public void`	`setReceiversWhiteList(List<String> allowedReceivers)` Legacy alias for setAllowedReceivers(List)
	`public void`	`setStarImportsBlacklist(List<String> disallowedStarImports)` Legacy alias for setDisallowedStarImports(List)
	`public void`	`setStarImportsWhitelist(List<String> allowedStarImports)` Legacy alias for setAllowedStarImports(List)
	`public void`	`setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)` Legacy alias for setDisallowedStatements(List)
	`public void`	`setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)` Legacy alias for setAllowedStatements(List)
	`public void`	`setStaticImportsBlacklist(List<String> disallowedStaticImports)` Legacy alias for setDisallowedStaticImports(List)
	`public void`	`setStaticImportsWhitelist(List<String> allowedStaticImports)` Legacy alias for setAllowedStaticImports(List)
	`public void`	`setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)` Legacy alias for setDisallowedStaticStarImports(List)
	`public void`	`setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)` Legacy alias for setAllowedStaticStarImports(List)
	`public void`	`setTokensBlacklist(List<Integer> disallowedTokens)` Legacy alias for setDisallowedTokens(List).
	`public void`	`setTokensWhitelist(List<Integer> allowedTokens)` Legacy alias for setAllowedTokens(List)

Inherited Methods Summary

Inherited Methods
Methods inherited from class	Name
`class CompilationCustomizer`	`getPhase`

- Constructor Detail
  - public SecureASTCustomizer()
    
    Creates a secure AST customizer that runs during canonicalization.
- Method Detail
  - public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker checkers)
    
    Adds expression checkers consulted in addition to the allow/disallow lists.
    Parameters:
    checkers - the expression checkers to add
  - public void addStatementCheckers(SecureASTCustomizer.StatementChecker checkers)
    
    Adds statement checkers consulted in addition to the allow/disallow lists.
    Parameters:
    checkers - the statement checkers to add
  - protected void assertImportIsAllowed(String className)
    
    Verifies that a regular import is allowed by the current configuration.
    Parameters:
    className - the imported class name
  - protected void assertStarImportIsAllowed(String packageName)
    
    Verifies that a star import is allowed by the current configuration.
    Parameters:
    packageName - the star import to check
  - protected void assertStaticImportIsAllowed(String member, String className)
    
    Verifies that a static import is allowed by the current configuration.
    Parameters:
    member - the imported member name
    className - the declaring class name
  - public void call(SourceUnit source, GeneratorContext context, ClassNode classNode)
    
    Verifies the configured security rules against the current source unit and class.
    throws:
    CompilationFailedException if verification fails
    
    Parameters:
    source - the source unit being customized
    context - the current generator context
    classNode - the class node being customized
  - protected void checkMethodDefinitionAllowed(ClassNode owner)
    
    Ensures the supplied class does not declare methods when such definitions are forbidden.
    Parameters:
    owner - the class to inspect
  - protected GroovyCodeVisitor createGroovyCodeVisitor()
    
    Creates the visitor that enforces statement and expression restrictions.
    Returns:
    the security-checking visitor
  - protected static List<MethodNode> filterMethods(ClassNode owner)
    
    Returns the non-synthetic methods declared directly by the supplied class.
    Parameters:
    owner - the class to inspect
    Returns:
    the directly declared, non-synthetic methods
  - public List<String> getAllowedConstantTypes()
    
    Returns the list of allowed constant or variable types.
    Returns:
    the allowed constant types, or null
  - public List<Class<? extends Expression>> getAllowedExpressions()
    
    Returns the list of allowed expression node types.
    Returns:
    the allowed expression types, or null
  - public List<String> getAllowedImports()
    
    Returns the list of explicitly allowed imports.
    Returns:
    the allowed imports, or null
  - public List<String> getAllowedReceivers()
    
    Returns the list of receiver types on which calls are allowed.
    Returns:
    the allowed receiver types, or null
  - public List<String> getAllowedStarImports()
    
    Returns the list of allowed star imports.
    Returns:
    the allowed star imports, or null
  - public List<Class<? extends Statement>> getAllowedStatements()
    
    Returns the list of allowed statement node types.
    Returns:
    the allowed statement types, or null
  - public List<String> getAllowedStaticImports()
    
    Returns the list of allowed static imports.
    Returns:
    the allowed static imports, or null
  - public List<String> getAllowedStaticStarImports()
    
    Returns the list of allowed static star imports.
    Returns:
    the allowed static star imports, or null
  - public List<Integer> getAllowedTokens()
    
    Returns the list of allowed token types.
    Returns:
    the allowed token types, or null
  - @Deprecated
    public List<String> getConstantTypesBlackList()
    
    Legacy alias for getDisallowedConstantTypes()
  - @Deprecated
    public List<String> getConstantTypesWhiteList()
    
    Legacy alias for getAllowedStatements()
  - public List<String> getDisallowedConstantTypes()
    
    Returns the list of disallowed constant or variable types.
    Returns:
    the disallowed constant types, or null
  - public List<Class<? extends Expression>> getDisallowedExpressions()
    
    Returns the list of disallowed expression node types.
    Returns:
    the disallowed expression types, or null
  - public List<String> getDisallowedImports()
    
    Returns the list of explicitly disallowed imports.
    Returns:
    the disallowed imports, or null
  - public List<String> getDisallowedReceivers()
    
    Returns the list of receiver types on which calls are disallowed.
    Returns:
    the disallowed receiver types, or null
  - public List<String> getDisallowedStarImports()
    
    Returns the list of disallowed star imports.
    Returns:
    the disallowed star imports, or null
  - public List<Class<? extends Statement>> getDisallowedStatements()
    
    Returns the list of disallowed statement node types.
    Returns:
    the disallowed statement types, or null
  - public List<String> getDisallowedStaticImports()
    
    Returns the list of disallowed static imports.
    Returns:
    the disallowed static imports, or null
  - public List<String> getDisallowedStaticStarImports()
    
    Returns the list of disallowed static star imports.
    Returns:
    the disallowed static star imports, or null
  - public List<Integer> getDisallowedTokens()
    
    Returns the list of disallowed token types.
    Returns:
    the disallowed token types, or null
  - @Deprecated
    public List<Class<? extends Expression>> getExpressionsBlacklist()
    
    Legacy alias for getDisallowedExpressions()
  - @Deprecated
    public List<Class<? extends Expression>> getExpressionsWhitelist()
    
    Legacy alias for getAllowedExpressions()
  - @Deprecated
    public List<String> getImportsBlacklist()
    
    Legacy alias for getDisallowedImports()
  - @Deprecated
    public List<String> getImportsWhitelist()
    
    Legacy alias for getAllowedImports()
  - @Deprecated
    public List<String> getReceiversBlackList()
    
    Legacy alias for getDisallowedReceivers()
  - @Deprecated
    public List<String> getReceiversWhiteList()
    
    Legacy alias for getAllowedReceivers()
  - @Deprecated
    public List<String> getStarImportsBlacklist()
    
    Legacy alias for getDisallowedStarImports()
  - @Deprecated
    public List<String> getStarImportsWhitelist()
    
    Legacy alias for getAllowedStarImports()
  - @Deprecated
    public List<Class<? extends Statement>> getStatementsBlacklist()
    
    Legacy alias for getDisallowedStatements()
  - @Deprecated
    public List<Class<? extends Statement>> getStatementsWhitelist()
    
    Legacy alias for getAllowedStatements()
  - @Deprecated
    public List<String> getStaticImportsBlacklist()
    
    Legacy alias for getDisallowedStaticImports()
  - @Deprecated
    public List<String> getStaticImportsWhitelist()
    
    Legacy alias for getAllowedStaticImports()
  - @Deprecated
    public List<String> getStaticStarImportsBlacklist()
    
    Legacy alias for getDisallowedStaticStarImports()
  - @Deprecated
    public List<String> getStaticStarImportsWhitelist()
    
    Legacy alias for getAllowedStaticStarImports()
  - @Deprecated
    public List<Integer> getTokensBlacklist()
    
    Legacy alias for getDisallowedTokens()
  - @Deprecated
    public List<Integer> getTokensWhitelist()
    
    Legacy alias for getAllowedTokens()
  - public boolean isClosuresAllowed()
    
    Indicates whether closures are allowed.
    Returns:
    true if closures are allowed
  - public boolean isIndirectImportCheckEnabled()
    
    Indicates whether indirect import checks are enabled.
    Returns:
    true if indirect import checks are enabled
  - public boolean isMethodDefinitionAllowed()
    
    Indicates whether explicit method definitions are allowed.
    Returns:
    true if method definitions are allowed
  - public boolean isPackageAllowed()
    
    Indicates whether package declarations are allowed.
    Returns:
    true if package declarations are allowed
  - public void setAllowedConstantTypes(List<String> allowedConstantTypes)
    
    Sets the list of allowed constant or variable types.
    Parameters:
    allowedConstantTypes - the type names to allow
  - public void setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)
    
    An alternative way of setting constant types.
    Parameters:
    allowedConstantTypes - a list of classes.
  - public void setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)
    
    Sets the list of allowed expression node types.
    Parameters:
    allowedExpressions - the expression types to allow
  - public void setAllowedImports(List<String> allowedImports)
    
    Sets the list of explicitly allowed imports.
    Parameters:
    allowedImports - the imports to allow
  - public void setAllowedReceivers(List<String> allowedReceivers)
    
    Sets the list of classes which may accept method calls.
    Parameters:
    allowedReceivers - the list of accepted classes, as fully qualified names
  - public void setAllowedReceiversClasses(List<Class> allowedReceivers)
    
    An alternative way of setting receiver classes.
    Parameters:
    allowedReceivers - a list of classes.
  - public void setAllowedStarImports(List<String> allowedStarImports)
    
    Sets the list of allowed star imports.
    Parameters:
    allowedStarImports - the star imports to allow
  - public void setAllowedStatements(List<Class<? extends Statement>> allowedStatements)
    
    Sets the list of allowed statement node types.
    Parameters:
    allowedStatements - the statement types to allow
  - public void setAllowedStaticImports(List<String> allowedStaticImports)
    
    Sets the list of allowed static imports.
    Parameters:
    allowedStaticImports - the static imports to allow
  - public void setAllowedStaticStarImports(List<String> allowedStaticStarImports)
    
    Sets the list of allowed static star imports.
    Parameters:
    allowedStaticStarImports - the static star imports to allow
  - public void setAllowedTokens(List<Integer> allowedTokens)
    
    Sets the list of tokens which are permitted.
    Parameters:
    allowedTokens - the tokens. The values of the tokens must be those of Types
  - public void setClosuresAllowed(boolean closuresAllowed)
    
    Sets whether closures are allowed.
    Parameters:
    closuresAllowed - true to allow closures
  - public void setConstantTypesBlackList(List<String> constantTypesBlackList)
    
    Sets the list of disallowed constant or variable types.
    Parameters:
    constantTypesBlackList - the type names to reject
  - @Deprecated
    public void setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)
    
    Legacy alias for setDisallowedConstantTypesClasses(List)
  - @Deprecated
    public void setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)
    
    Legacy alias for setAllowedConstantTypesClasses(List)
  - @Deprecated
    public void setConstantTypesWhiteList(List<String> allowedConstantTypes)
    
    Legacy alias for setAllowedConstantTypes(List)
  - public void setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)
    
    An alternative way of setting constant types.
    Parameters:
    disallowedConstantTypes - a list of classes.
  - public void setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)
    
    Sets the list of disallowed expression node types.
    Parameters:
    disallowedExpressions - the expression types to reject
  - public void setDisallowedImports(List<String> disallowedImports)
    
    Sets the list of explicitly disallowed imports.
    Parameters:
    disallowedImports - the imports to reject
  - public void setDisallowedReceivers(List<String> disallowedReceivers)
    
    Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be relatively simple to bypass any disallowed list unless the disallowed receivers list contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also have MethodPointerExpression in the disallowed expressions list for the disallowed receivers list to function as a security check.
    Parameters:
    disallowedReceivers - the list of refused classes, as fully qualified names
  - public void setDisallowedReceiversClasses(List<Class> disallowedReceivers)
    
    An alternative way of setting receiver classes.
    Parameters:
    disallowedReceivers - a list of classes.
  - public void setDisallowedStarImports(List<String> disallowedStarImports)
    
    Sets the list of disallowed star imports.
    Parameters:
    disallowedStarImports - the star imports to reject
  - public void setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)
    
    Sets the list of disallowed statement node types.
    Parameters:
    disallowedStatements - the statement types to reject
  - public void setDisallowedStaticImports(List<String> disallowedStaticImports)
    
    Sets the list of disallowed static imports.
    Parameters:
    disallowedStaticImports - the static imports to reject
  - public void setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)
    
    Sets the list of disallowed static star imports.
    Parameters:
    disallowedStaticStarImports - the static star imports to reject
  - public void setDisallowedTokens(List<Integer> disallowedTokens)
    
    Sets the list of tokens which are not permitted.
    Parameters:
    disallowedTokens - the tokens. The values of the tokens must be those of Types
  - @Deprecated
    public void setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)
    
    Legacy alias for setDisallowedExpressions(List)
  - @Deprecated
    public void setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)
    
    Legacy alias for setAllowedExpressions(List)
  - @Deprecated
    public void setImportsBlacklist(List<String> disallowedImports)
    
    Legacy alias for setDisallowedImports(List)
  - @Deprecated
    public void setImportsWhitelist(List<String> allowedImports)
    
    Legacy alias for setAllowedImports(List)
  - public void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)
    
    Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.
    Parameters:
    indirectImportCheckEnabled - set to true to enable indirect checks
  - public void setMethodDefinitionAllowed(boolean methodDefinitionAllowed)
    
    Sets whether explicit method definitions are allowed.
    Parameters:
    methodDefinitionAllowed - true to allow method definitions
  - public void setPackageAllowed(boolean packageAllowed)
    
    Sets whether package declarations are allowed.
    Parameters:
    packageAllowed - true to allow package declarations
  - @Deprecated
    public void setReceiversBlackList(List<String> disallowedReceivers)
    
    Legacy alias for setDisallowedReceivers(List)
  - @Deprecated
    public void setReceiversClassesBlackList(List<Class> disallowedReceivers)
    
    Legacy alias for setDisallowedReceiversClasses(List).
  - @Deprecated
    public void setReceiversClassesWhiteList(List<Class> allowedReceivers)
    
    Legacy alias for setAllowedReceiversClasses(List)
  - @Deprecated
    public void setReceiversWhiteList(List<String> allowedReceivers)
    
    Legacy alias for setAllowedReceivers(List)
  - @Deprecated
    public void setStarImportsBlacklist(List<String> disallowedStarImports)
    
    Legacy alias for setDisallowedStarImports(List)
  - @Deprecated
    public void setStarImportsWhitelist(List<String> allowedStarImports)
    
    Legacy alias for setAllowedStarImports(List)
  - @Deprecated
    public void setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)
    
    Legacy alias for setDisallowedStatements(List)
  - @Deprecated
    public void setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)
    
    Legacy alias for setAllowedStatements(List)
  - @Deprecated
    public void setStaticImportsBlacklist(List<String> disallowedStaticImports)
    
    Legacy alias for setDisallowedStaticImports(List)
  - @Deprecated
    public void setStaticImportsWhitelist(List<String> allowedStaticImports)
    
    Legacy alias for setAllowedStaticImports(List)
  - @Deprecated
    public void setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)
    
    Legacy alias for setDisallowedStaticStarImports(List)
  - @Deprecated
    public void setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)
    
    Legacy alias for setAllowedStaticStarImports(List)
  - @Deprecated
    public void setTokensBlacklist(List<Integer> disallowedTokens)
    
    Legacy alias for setDisallowedTokens(List).
  - @Deprecated
    public void setTokensWhitelist(List<Integer> allowedTokens)
    
    Legacy alias for setAllowedTokens(List)

Summary:
Nested
Constructor
Method

| Detail:
Constructor
Method

[Java] Class SecureASTCustomizer

Nested Class Summary

Constructor Summary

Methods Summary

Inherited Methods Summary

Constructor Detail

public SecureASTCustomizer()

Method Detail

public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker checkers)

public void addStatementCheckers(SecureASTCustomizer.StatementChecker checkers)

protected void assertImportIsAllowed(String className)

protected void assertStarImportIsAllowed(String packageName)

protected void assertStaticImportIsAllowed(String member, String className)

public void call(SourceUnit source, GeneratorContext context, ClassNode classNode)

protected void checkMethodDefinitionAllowed(ClassNode owner)

protected GroovyCodeVisitor createGroovyCodeVisitor()

protected static List<MethodNode> filterMethods(ClassNode owner)

public List<String> getAllowedConstantTypes()

public List<Class<? extends Expression>> getAllowedExpressions()

public List<String> getAllowedImports()

public List<String> getAllowedReceivers()

public List<String> getAllowedStarImports()

public List<Class<? extends Statement>> getAllowedStatements()

public List<String> getAllowedStaticImports()

public List<String> getAllowedStaticStarImports()

public List<Integer> getAllowedTokens()

@Deprecatedpublic List<String> getConstantTypesBlackList()

@Deprecatedpublic List<String> getConstantTypesWhiteList()

public List<String> getDisallowedConstantTypes()

public List<Class<? extends Expression>> getDisallowedExpressions()

public List<String> getDisallowedImports()

public List<String> getDisallowedReceivers()

public List<String> getDisallowedStarImports()

public List<Class<? extends Statement>> getDisallowedStatements()

public List<String> getDisallowedStaticImports()

public List<String> getDisallowedStaticStarImports()

public List<Integer> getDisallowedTokens()

@Deprecatedpublic List<Class<? extends Expression>> getExpressionsBlacklist()

@Deprecatedpublic List<Class<? extends Expression>> getExpressionsWhitelist()

@Deprecatedpublic List<String> getImportsBlacklist()

@Deprecatedpublic List<String> getImportsWhitelist()

@Deprecatedpublic List<String> getReceiversBlackList()

@Deprecatedpublic List<String> getReceiversWhiteList()

@Deprecatedpublic List<String> getStarImportsBlacklist()

@Deprecatedpublic List<String> getStarImportsWhitelist()

@Deprecatedpublic List<Class<? extends Statement>> getStatementsBlacklist()

@Deprecatedpublic List<Class<? extends Statement>> getStatementsWhitelist()

@Deprecatedpublic List<String> getStaticImportsBlacklist()

@Deprecatedpublic List<String> getStaticImportsWhitelist()

@Deprecatedpublic List<String> getStaticStarImportsBlacklist()

@Deprecatedpublic List<String> getStaticStarImportsWhitelist()

@Deprecatedpublic List<Integer> getTokensBlacklist()

@Deprecatedpublic List<Integer> getTokensWhitelist()

public boolean isClosuresAllowed()

public boolean isIndirectImportCheckEnabled()

public boolean isMethodDefinitionAllowed()

public boolean isPackageAllowed()

public void setAllowedConstantTypes(List<String> allowedConstantTypes)

public void setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)

public void setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)

public void setAllowedImports(List<String> allowedImports)

public void setAllowedReceivers(List<String> allowedReceivers)

public void setAllowedReceiversClasses(List<Class> allowedReceivers)

public void setAllowedStarImports(List<String> allowedStarImports)

public void setAllowedStatements(List<Class<? extends Statement>> allowedStatements)

public void setAllowedStaticImports(List<String> allowedStaticImports)

public void setAllowedStaticStarImports(List<String> allowedStaticStarImports)

public void setAllowedTokens(List<Integer> allowedTokens)

public void setClosuresAllowed(boolean closuresAllowed)

public void setConstantTypesBlackList(List<String> constantTypesBlackList)

@Deprecatedpublic void setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)

@Deprecatedpublic void setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)

@Deprecatedpublic void setConstantTypesWhiteList(List<String> allowedConstantTypes)

public void setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)

public void setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)

public void setDisallowedImports(List<String> disallowedImports)

public void setDisallowedReceivers(List<String> disallowedReceivers)

public void setDisallowedReceiversClasses(List<Class> disallowedReceivers)

public void setDisallowedStarImports(List<String> disallowedStarImports)

public void setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)

@Deprecated
public List<String> getConstantTypesBlackList()

@Deprecated
public List<String> getConstantTypesWhiteList()

@Deprecated
public List<Class<? extends Expression>> getExpressionsBlacklist()

@Deprecated
public List<Class<? extends Expression>> getExpressionsWhitelist()

@Deprecated
public List<String> getImportsBlacklist()

@Deprecated
public List<String> getImportsWhitelist()

@Deprecated
public List<String> getReceiversBlackList()

@Deprecated
public List<String> getReceiversWhiteList()

@Deprecated
public List<String> getStarImportsBlacklist()

@Deprecated
public List<String> getStarImportsWhitelist()

@Deprecated
public List<Class<? extends Statement>> getStatementsBlacklist()

@Deprecated
public List<Class<? extends Statement>> getStatementsWhitelist()

@Deprecated
public List<String> getStaticImportsBlacklist()

@Deprecated
public List<String> getStaticImportsWhitelist()

@Deprecated
public List<String> getStaticStarImportsBlacklist()

@Deprecated
public List<String> getStaticStarImportsWhitelist()

@Deprecated
public List<Integer> getTokensBlacklist()

@Deprecated
public List<Integer> getTokensWhitelist()

@Deprecated
public void setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)

@Deprecated
public void setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)

@Deprecated
public void setConstantTypesWhiteList(List<String> allowedConstantTypes)

@Deprecated
public void setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)

@Deprecated
public void setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)

@Deprecated
public void setImportsBlacklist(List<String> disallowedImports)

@Deprecated
public void setImportsWhitelist(List<String> allowedImports)

@Deprecated
public void setReceiversBlackList(List<String> disallowedReceivers)

@Deprecated
public void setReceiversClassesBlackList(List<Class> disallowedReceivers)

@Deprecated
public void setReceiversClassesWhiteList(List<Class> allowedReceivers)

@Deprecated
public void setReceiversWhiteList(List<String> allowedReceivers)

@Deprecated
public void setStarImportsBlacklist(List<String> disallowedStarImports)

@Deprecated
public void setStarImportsWhitelist(List<String> allowedStarImports)

@Deprecated
public void setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)

@Deprecated
public void setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)

@Deprecated
public void setStaticImportsBlacklist(List<String> disallowedStaticImports)

@Deprecated
public void setStaticImportsWhitelist(List<String> allowedStaticImports)

@Deprecated
public void setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)

@Deprecated
public void setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)

@Deprecated
public void setTokensBlacklist(List<Integer> disallowedTokens)

@Deprecated
public void setTokensWhitelist(List<Integer> allowedTokens)