Examples with GroovyValueFilter org.kohsuke.groovy.sandbox.GroovyValueFilter used on opensource projects

Example 1 with GroovyValueFilter

use of org.kohsuke.groovy.sandbox.GroovyValueFilter in project ontrack by nemerosa.

the class ExpressionEngineImpl method resolve.

public String resolve(final String expression, Map<String, ?> parameters) {
    SandboxTransformer sandboxTransformer = new SandboxTransformer();
    SecureASTCustomizer secure = new SecureASTCustomizer();
    secure.setClosuresAllowed(false);
    secure.setMethodDefinitionAllowed(false);
    CompilerConfiguration compilerConfiguration = new CompilerConfiguration();
    compilerConfiguration.addCompilationCustomizers(sandboxTransformer, secure);
    Binding binding = new Binding(parameters);
    GroovyShell shell = new GroovyShell(binding, compilerConfiguration);
    // Sandbox registration (thread level)
    GroovyValueFilter sandboxFilter = new GroovyValueFilter() {

        @Override
        public Object filter(Object o) {
            if (o == null || o instanceof String || o instanceof GString || o.getClass().getName().equals("Script1")) {
                return o;
            } else if (o instanceof Class) {
                throw new ExpressionCompilationException(expression, String.format("%n- %s class cannot be accessed.", ((Class) o).getName()));
            } else {
                throw new ExpressionCompilationException(expression, String.format("%n- %s class cannot be accessed.", o.getClass().getName()));
            }
        }
    };
    try {
        sandboxFilter.register();
        Object result = shell.evaluate(expression);
        if (result == null) {
            return null;
        } else if (!(result instanceof String)) {
            throw new ExpressionNotStringException(expression);
        } else {
            return (String) result;
        }
    } catch (MissingPropertyException e) {
        throw new ExpressionCompilationException(expression, "No such property: " + e.getProperty());
    } catch (MultipleCompilationErrorsException e) {
        StringWriter s = new StringWriter();
        PrintWriter p = new PrintWriter(s);
        @SuppressWarnings("unchecked") List<Message> errors = e.getErrorCollector().getErrors();
        errors.forEach((Message message) -> writeErrorMessage(p, message));
        throw new ExpressionCompilationException(expression, s.toString());
    } finally {
        sandboxFilter.unregister();
    }
}