Fold groovy-sandbox into script-security-plugin

groovy-sandbox/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2012-2014 Kohsuke Kawaguchi, CloudBees, Inc., other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

groovy-sandbox/README.md

@@ -0,0 +1,8 @@
+groovy-sandbox
+==============
+
+**WARNING** This library is only maintained in the context of Jenkins, and should only be used as a dependency of Jenkins plugins such as [Script Security Plugin](https://plugins.jenkins.io/script-security) and [Pipeline: Groovy Plugin](https://plugins.jenkins.io/workflow-cps). It should be considered deprecated and unsafe for all other purposes.
+
+This library provides a compile-time transformer to run Groovy code in an environment in which most operations, such as method calls, are intercepted before being executed. Consumers of the library can hook into the interception to allow or deny specific operations.
+
+This library is **not secure** when used by itself. In particular, you must at least use an additional `CompilationCustomizer` along the lines of [RejectASTTransformsCustomizer](https://github.com/jenkinsci/script-security-plugin/blob/c43e099f2f86425b32b0be492020313644062763/src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/RejectASTTransformsCustomizer.java) to reject AST transformations that can bypass the sandbox, and you need to take special care to ensure untrusted scripts are both parsed and executed inside of the sandbox.

groovy-sandbox/ast.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# show the AST tree of the specified Groovy file in GUI
+exec groovy -e 'groovy.inspect.swingui.AstBrowser.main(args)' "$@"

groovy-sandbox/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>org.jenkins-ci.plugins</groupId>
+    <artifactId>script-security-parent</artifactId>
+    <version>${changelist}</version>
+  </parent>
+
+  <groupId>org.kohsuke</groupId>
+  <artifactId>groovy-sandbox</artifactId>
+  <url>https://github.com/jenkinsci/script-security-plugin</url>
+
+  <name>Groovy Sandbox</name>
+  <description>Executes untrusted Groovy script safely</description>
+
+  <properties>
+    <!-- ClassRecorder is used by groovy-cps -->
+    <no-test-jar>false</no-test-jar>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.codehaus.groovy</groupId>
+      <artifactId>groovy</artifactId>
+      <version>2.4.21</version> <!-- Note: Do not update past this version unless Jenkins core is updated to use a newer version of Groovy. -->
+    </dependency>
+  </dependencies>
+
+  <licenses>
+    <license>
+      <name>MIT License</name>
+      <url>https://opensource.org/licenses/MIT</url>
+    </license>
+  </licenses>
+</project>

groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/GroovyInterceptor.java

@@ -0,0 +1,224 @@
+package org.kohsuke.groovy.sandbox;
+
+import org.kohsuke.groovy.sandbox.impl.Super;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+
+/**
+ * Interceptor of Groovy method calls.
+ *
+ * <p>
+ * Once created, it needs to be {@linkplain #register() registered} to start receiving interceptions.
+ * List of interceptors are maintained per thread.
+ *
+ * @author Kohsuke Kawaguchi
+ */
+public abstract class GroovyInterceptor {
+    /**
+     * Intercepts an instance method call on some object of the form "foo.bar(...)"
+     */
+    public Object onMethodCall(Invoker invoker, Object receiver, String method, Object... args) throws Throwable {
+        return invoker.call(receiver,method,args);
+    }
+
+    /**
+     * Intercepts a static method call on some class, like "Class.forName(...)".
+     * 
+     * Note that Groovy doesn't clearly differentiate static method calls from instance method calls.
+     * If calls are determined to be static at compile-time, you get this method called, but
+     * method calls whose receivers are {@link Class} can invoke static methods, too
+     * (that is, {@code x=Integer.class;x.valueOf(5)} results in {@code onMethodCall(invoker,Integer.class,"valueOf",5)}
+     */
+    public Object onStaticCall(Invoker invoker, Class receiver, String method, Object... args) throws Throwable {
+        return invoker.call(receiver,method,args);
+    }
+
+    /**
+     * Intercepts an object instantiation, like "new Receiver(...)"
+     */
+    public Object onNewInstance(Invoker invoker, Class receiver, Object... args) throws Throwable {
+        return invoker.call(receiver,null,args);
+    }
+
+    /**
+     * Intercepts an super method call, like "super.foo(...)"
+     */
+    public Object onSuperCall(Invoker invoker, Class senderType, Object receiver, String method, Object... args) throws Throwable {
+        return invoker.call(new Super(senderType,receiver),method,args);
+    }
+
+    /**
+     * Intercepts a {@code super(…)} call from a constructor.
+     */
+    public void onSuperConstructor(Invoker invoker, Class receiver, Object... args) throws Throwable {
+        onNewInstance(invoker, receiver, args);
+    }
+
+    /**
+     * Intercepts a property access, like "z=foo.bar"
+     * 
+     * @param receiver
+     *      'foo' in the above example, the object whose property is accessed.
+     * @param property
+     *      'bar' in the above example, the name of the property
+     */
+    public Object onGetProperty(Invoker invoker, Object receiver, String property) throws Throwable {
+        return invoker.call(receiver,property);
+    }
+
+    /**
+     * Intercepts a property assignment like "foo.bar=z"
+     *
+     * @param receiver
+     *      'foo' in the above example, the object whose property is accessed.
+     * @param property
+     *      'bar' in the above example, the name of the property
+     * @param value
+     *      The value to be assigned.
+     * @return
+     *      The result of the assignment expression. Normally, you should return the same object as {@code value}.
+     */
+    public Object onSetProperty(Invoker invoker, Object receiver, String property, Object value) throws Throwable {
+        return invoker.call(receiver,property,value);
+    }
+
+    /**
+     * Intercepts an attribute access, like "z=foo.@bar"
+     *
+     * @param receiver
+     *      'foo' in the above example, the object whose attribute is accessed.
+     * @param attribute
+     *      'bar' in the above example, the name of the attribute
+     */
+    public Object onGetAttribute(Invoker invoker, Object receiver, String attribute) throws Throwable {
+        return invoker.call(receiver, attribute);
+    }
+
+    /**
+     * Intercepts an attribute assignment like "foo.@bar=z"
+     *
+     * @param receiver
+     *      'foo' in the above example, the object whose attribute is accessed.
+     * @param attribute
+     *      'bar' in the above example, the name of the attribute
+     * @param value
+     *      The value to be assigned.
+     * @return
+     *      The result of the assignment expression. Normally, you should return the same object as {@code value}.
+     */
+    public Object onSetAttribute(Invoker invoker, Object receiver, String attribute, Object value) throws Throwable {
+        return invoker.call(receiver,attribute,value);
+    }
+
+    /**
+     * Intercepts an array access, like "z=foo[bar]"
+     *
+     * @param receiver
+     *      'foo' in the above example, the array-like object.
+     * @param index
+     *      'bar' in the above example, the object that acts as an index.
+     */
+    public Object onGetArray(Invoker invoker, Object receiver, Object index) throws Throwable {
+        return invoker.call(receiver,null,index);
+    }
+
+    /**
+     * Intercepts an attribute assignment like "foo[bar]=z"
+     *
+     * @param receiver
+     *      'foo' in the above example, the array-like object.
+     * @param index
+     *      'bar' in the above example, the object that acts as an index.
+     * @param value
+     *      The value to be assigned.
+     * @return
+     *      The result of the assignment expression. Normally, you should return the same object as {@code value}.
+     */
+    public Object onSetArray(Invoker invoker, Object receiver, Object index, Object value) throws Throwable {
+        return invoker.call(receiver,null,index,value);
+    }
+
+    /**
+     * Represents the next interceptor in the chain.
+     * 
+     * As {@link GroovyInterceptor}, you intercept by doing one of the following:
+     * 
+     * <ul>
+     *     <li>Pass on to the next interceptor by calling one of the call() method,
+     *         possibly modifying the arguments and return values, intercepting an exception, etc.
+     *     <li>Throws an exception to block the call.
+     *     <li>Return some value without calling the next interceptor.
+     * </ul>
+     * 
+     * The signature of the call method is as follows:
+     * 
+     * <dl>
+     *     <dt>receiver</dt>
+     *     <dd>
+     *         The object whose method/property is accessed.
+     *         For constructor invocations and static calls, this is {@link Class}.
+     *         If the receiver is null, all the interceptors will be skipped.
+     *     </dd>
+     *     <dt>method</dt>
+     *     <dd>
+     *         The name of the method/property/attribute. Otherwise pass in null.
+     *     </dd>
+     *     <dt>args</dt>
+     *     <dd>
+     *         Arguments of the method call, index of the array access, and/or values to be set.
+     *         Multiple override of the call method is provided to avoid the implicit object
+     *         array creation, but otherwise they behave the same way.
+     *     </dd>
+     * </dl>
+     */
+    public interface Invoker {
+        Object call(Object receiver, String method) throws Throwable;
+        Object call(Object receiver, String method, Object arg1) throws Throwable;
+        Object call(Object receiver, String method, Object arg1, Object arg2) throws Throwable;
+        Object call(Object receiver, String method, Object... args) throws Throwable;
+    }
+
+//    public void addToGlobal() {
+//        globalInterceptors.add(this);
+//    }
+//
+//    public void removeFromGlobal() {
+//        globalInterceptors.remove(this);
+//    }
+
+    /**
+     * Registers this interceptor to the current thread's interceptor list.
+     */
+    public void register() {
+        threadInterceptors.get().add(this);
+    }
+
+    /**
+     * Reverses the earlier effect of {@link #register()}
+     */
+    public void unregister() {
+        threadInterceptors.get().remove(this);
+    }
+
+    private static final ThreadLocal<List<GroovyInterceptor>> threadInterceptors = new ThreadLocal<List<GroovyInterceptor>>() {
+        @Override
+        protected List<GroovyInterceptor> initialValue() {
+            return new CopyOnWriteArrayList<GroovyInterceptor>();
+        }
+    };
+
+    private static final ThreadLocal<List<GroovyInterceptor>> threadInterceptorsView = new ThreadLocal<List<GroovyInterceptor>>() {
+        @Override
+        protected List<GroovyInterceptor> initialValue() {
+            return Collections.unmodifiableList(threadInterceptors.get());
+        }
+    };
+
+//    private static final List<GroovyInterceptor> globalInterceptors = new CopyOnWriteArrayList<GroovyInterceptor>();
+
+    public static List<GroovyInterceptor> getApplicableInterceptors() {
+        return threadInterceptorsView.get();
+    }
+}

groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/GroovyValueFilter.java

@@ -0,0 +1,100 @@
+package org.kohsuke.groovy.sandbox;
+
+import groovy.lang.Binding;
+import groovy.lang.Script;
+
+/**
+ * @deprecated
+ */
+@Deprecated
+public class GroovyValueFilter extends GroovyInterceptor {
+    /**
+     * Called for every receiver.
+      */
+    public Object filterReceiver(Object receiver) {
+        return filter(receiver);
+    }
+
+    /**
+     * Called for a return value of a method call, newly created object, retrieve property/attribute values.
+      */
+    public Object filterReturnValue(Object returnValue) {
+        return filter(returnValue);
+    }
+
+    /**
+     * Called for every argument to method/constructor calls.
+      */
+    public Object filterArgument(Object arg) {
+        return filter(arg);
+    }
+
+    /**
+     * Called for every index of the array get/set access.
+      */
+    public Object filterIndex(Object index) {
+        return filter(index);
+    }
+
+    /**
+     * All the specific {@code filterXXX()} methods delegate to this method.
+     */
+    public Object filter(Object o) {
+        return o;
+    }
+
+    private Object[] filterArguments(Object[] args) {
+        for (int i=0; i<args.length; i++)
+            args[i] = filterArgument(args[i]);
+        return args;
+    }
+
+    @Override
+    public Object onMethodCall(Invoker invoker, Object receiver, String method, Object... args) throws Throwable {
+        return filterReturnValue(super.onMethodCall(invoker, filterReceiver(receiver), method, filterArguments(args)));
+    }
+
+    @Override
+    public Object onStaticCall(Invoker invoker, Class receiver, String method, Object... args) throws Throwable {
+        return filterReturnValue(super.onStaticCall(invoker, (Class)filterReceiver(receiver), method, filterArguments(args)));
+    }
+
+    @Override
+    public Object onNewInstance(Invoker invoker, Class receiver, Object... args) throws Throwable {
+        if (receiver == Script.class && args.length == 1 && args[0] instanceof Binding) {
+            // Ignore initial script instantiation.
+            return super.onNewInstance(invoker, receiver, args);
+        }
+        return filterReturnValue(super.onNewInstance(invoker, (Class)filterReceiver(receiver), filterArguments(args)));
+    }
+
+    @Override
+    public Object onGetProperty(Invoker invoker, Object receiver, String property) throws Throwable {
+        return filterReturnValue(super.onGetProperty(invoker, filterReceiver(receiver), property));
+    }
+
+    @Override
+    public Object onSetProperty(Invoker invoker, Object receiver, String property, Object value) throws Throwable {
+        return filterReturnValue(super.onSetProperty(invoker, filterReceiver(receiver), property, filterArgument(value)));
+    }
+
+    @Override
+    public Object onGetAttribute(Invoker invoker, Object receiver, String attribute) throws Throwable {
+        return filterReturnValue(super.onGetAttribute(invoker, filterReceiver(receiver), attribute));
+    }
+
+    @Override
+    public Object onSetAttribute(Invoker invoker, Object receiver, String attribute, Object value) throws Throwable {
+        return filterReturnValue(super.onSetAttribute(invoker, filterReceiver(receiver), attribute, filterArgument(value)));
+    }
+
+    @Override
+    public Object onGetArray(Invoker invoker, Object receiver, Object index) throws Throwable {
+        return filterReturnValue(super.onGetArray(invoker, filterReceiver(receiver), filterIndex(index)));
+    }
+
+    @Override
+    public Object onSetArray(Invoker invoker, Object receiver, Object index, Object value) throws Throwable {
+        return filterReturnValue(super.onSetArray(invoker, filterReceiver(receiver), filterIndex(index), filterArgument(value)));
+    }
+}