Prevent calling System functions in subclasses in a groovy script with SecureASTCustomizer

Viewed 196

I am working on a possibility to call a groovy script from java for some calculations. Since those calculations can be used by any people, the syntax of the script has to be restricted. So I want to restrict the call of any method of the System class or other harmful methods, like System.exit(0). I am using the CompilerConfiguration with an SecureASTCustimizer with the following settings.

CompilerConfiguration conf = new CompilerConfiguration();
SecureASTCustomizer customizer = new SecureASTCustomizer();     
customizer.setClosuresAllowed(true);    
customizer.setMethodDefinitionAllowed(false); 
customizer.setPackageAllowed(false);
customizer.setIndirectImportCheckEnabled(true);
customizer.setReceiversWhiteList(Arrays.asList("java.lang.Object","java.lang.Math", "org.codehaus.groovy.runtime.InvokerHelper"));
        customizer.setImportsWhitelist(Arrays.asList("java.lang.Math","classWithinScript","java.lang.Object", "org.codehaus.groovy.runtime.InvokerHelper"));

conf.addCompilationCustomizers(customizer);

The groovy script looks like this:

// For table definitions
class classWithinScript{
    String TestName;
    int value;
}
System.exit(0)
//Some calcualtions are done here

This works perfectly, if now someone enters System.exit(0) the execution is blocked.

But when I change the class to:

class classWithinScript{
    String TestName;
    int value;
        def any = System.exit(0)
}
//Some calculations

the application is terminated.

How can I prevent this call of System.exit() in this way?

0 Answers
Related