How to secure scripting with JSR 223?

Question

I use Groovy as dynamic script engine to allow admin users of my web application to create little scripts as part of an interface solution, eg. do simple string operations, tokenize and so on.
Unfortunately that opens quite a big loophole because per default the script engine would execute anything.
I described a demo app here: http://javadude.wordpress.com/2011/06/29/creating-a-zk-groovy-console/

Object value = shell.evaluate("whatever groovy script");

You can execute System.exit(0) which shuts down the AS or even shell commands like "ls -l".execute().textor just snoop around system settings println InetAddress.localHost.hostAddress

I could do a string check before executing, like filter for System.xyz or execute.xyz

You could also check my answer at stackoverflow.com/questions/9681413/… — tnabeel
– tnabeel, Commented Apr 19, 2016 at 0:25

Cody Gray · Accepted Answer · 2022-04-25 21:56:17Z

4

With groovy 1.8, you can customize the compiler configuration

There's a blog post here which explains more.

You should aso read:

edited Apr 25, 2022 at 21:56

Cody Gray♦

246k53 gold badges512 silver badges591 bronze badges

answered Jul 8, 2011 at 9:54

tim_yates

172k29 gold badges359 silver badges354 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to secure scripting with JSR 223?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related