I am working on a possibility to call a groovy script from java for some calculations. Since those calculations can be used by any people, the syntax of the script has to be restricted. So I want to restrict the call of any method of the System class or other harmful methods, like System.exit(0). I am using the CompilerConfiguration with an SecureASTCustimizer with the following settings.
CompilerConfiguration conf = new CompilerConfiguration();
SecureASTCustomizer customizer = new SecureASTCustomizer();
customizer.setClosuresAllowed(true);
customizer.setMethodDefinitionAllowed(false);
customizer.setPackageAllowed(false);
customizer.setIndirectImportCheckEnabled(true);
customizer.setReceiversWhiteList(Arrays.asList("java.lang.Object","java.lang.Math", "org.codehaus.groovy.runtime.InvokerHelper"));
customizer.setImportsWhitelist(Arrays.asList("java.lang.Math","classWithinScript","java.lang.Object", "org.codehaus.groovy.runtime.InvokerHelper"));
conf.addCompilationCustomizers(customizer);
The groovy script looks like this:
// For table definitions
class classWithinScript{
String TestName;
int value;
}
System.exit(0)
//Some calcualtions are done here
This works perfectly, if now someone enters System.exit(0) the execution is blocked.
But when I change the class to:
class classWithinScript{
String TestName;
int value;
def any = System.exit(0)
}
//Some calculations
the application is terminated.
How can I prevent this call of System.exit() in this way?