[JIRA] (JENKINS-36206) Add staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods drop java.lang.CharSequence int to generic-whiteliest

閲覧: 4 回

最初の未読メッセージにスキップ

owood@cloudbees.com (JIRA)

未読、

2016/06/23 23:29:022016/06/23

To: jenkinsc...@googlegroups.com

Owen Wood created an issue

Jenkins /

JENKINS-36206

Add staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods drop java.lang.CharSequence int to generic-whiteliest

Issue Type:	Improvement
Assignee:	Jesse Glick
Components:	script-security-plugin
Created:	2016/Jun/24 3:28 AM
Priority:	Minor
Reporter:	Owen Wood

Pending review of course. Not sure what security implications there might be here.

To reproduce:

 
                                                                node {
    env.WORKSPACE = pwd()
    test = env.WORKSPACE.drop(3)
}

Results in:

 
                                                                org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods drop java.lang.CharSequence int
	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:174)

Reproducible with Sandbox enabled (or using Jenkinsfile obviously)