Script Security Plugin Usability

[Mark Bidewell]

I recognize the need for secure scripting sandboxes, but it seems as though the sandbox often excludes functions that are useful.  The most recent example is the following snippet

def testList = [0, 1, 2, 3]

def testRange = testList[0..2]

Which yields the error:

ERROR: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection

a straight index access works:  def testVal = testList[2]

For a critical plugin the script security sandbox has very poor usability. In addition to errors like the one above, the plugin does not allow fine grained permissions management. For example:

• The only way to add new signatures is to repeatedly run a script until a failure point.  This is painful when moving a script from a test environment to a production environment.
• You cannot individually manage approved signatures.  If a signature needs to be removed, the only option is invalidating all approvals and repeatedly run scripts to generate approvals.

Are there plans to improve the plugins usability?

[Jesse Glick]

On Wed, Apr 10, 2019 at 10:26 AM Mark Bidewell <mbid...@gmail.com> wrote:
> Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection

Not sure I ever came across that particular bit of Groovy syntax
before, but feel free to add an addition to the default whitelist for
it.

> The only way to add new signatures is to repeatedly run a script until a failure point. This is painful when moving a script from a test environment to a production environment.

Cannot remember if this was filed or not. In principle it might be
possible for Pipeline builds (not other uses of the Groovy sandbox) to
pause after a rejection and wait for approval or cancellation. Tricky.

> You cannot individually manage approved signatures. If a signature needs to be removed, the only option is invalidating all approvals and repeatedly run scripts to generate approvals.

This is definitely a filed RFE.

> Are there plans to improve the plugins usability?

No particular plans that I know of. The general recommendation is to
use Declarative Pipeline when possible, for which `script-security` is
moot, or generally to avoid doing nontrivial work at the Groovy glue
layer.