Abandon evaluating script to avoid security issues

Project: http://git-wip-us.apache.org/repos/asf/groovy/repo
Commit: http://git-wip-us.apache.org/repos/asf/groovy/commit/1d20e307
Tree: http://git-wip-us.apache.org/repos/asf/groovy/tree/1d20e307
Diff: http://git-wip-us.apache.org/repos/asf/groovy/diff/1d20e307

Branch: refs/heads/master
Commit: 1d20e307251aedde4f73abe879e2b548f2d16a17
Parents: 8e24158
Author: Daniel Sun <sun...@apache.org>
Authored: Sun Nov 4 22:07:32 2018 +0800
Committer: Daniel Sun <sun...@apache.org>
Committed: Sun Nov 4 23:43:06 2018 +0800

----------------------------------------------------------------------
 src/main/groovy/groovy/util/GProperties.groovy  | 66 +++++---------------
 .../groovy/util/gproperties.properties          |  6 +-
 .../groovy/util/gproperties_import2.properties  |  2 +-
 src/test/groovy/util/GPropertiesTest.groovy     | 38 ++---------
 4 files changed, 21 insertions(+), 91 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/groovy/blob/1d20e307/src/main/groovy/groovy/util/GProperties.groovy
----------------------------------------------------------------------
diff --git a/src/main/groovy/groovy/util/GProperties.groovy 
b/src/main/groovy/groovy/util/GProperties.groovy
index 500baf5..fe42982 100644
--- a/src/main/groovy/groovy/util/GProperties.groovy
+++ b/src/main/groovy/groovy/util/GProperties.groovy
@@ -57,26 +57,15 @@ import java.util.regex.Pattern
  *      assert 'Hello,Daniel' == gp.getProperty('greeting.daniel')
  * </pre>
  *
- * 3) Evaluating with ${...}, e.g.
+ * 3) Escaping with {{...}}, e.g.
  * <pre>
  *      # gproperties.properties
- *      greeting.daniel=Hello,Daniel in ${new 
java.text.SimpleDateFormat('yyyyMMdd').format(new Date())}
+ *      greeting.daniel={{groovy.greeting}},{{some.name}}
  *
  *      // groovy script
- *      def gp = new GProperties(true) // Note: we should enable evaluating 
script manually
- *      
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
- *      assert 'Hello,Daniel in 2018' == gp.getProperty('greeting.daniel') // 
Given running the script in 2018
- * </pre>
- *
- * 4) Escaping with {{...}}, ${{...}}, e.g.
- * <pre>
- *      # gproperties.properties
- *      greeting.daniel={{groovy.greeting}},{{some.name}} in ${{new 
java.text.SimpleDateFormat('yyyyMMdd').format(new Date())}}
- *
- *      // groovy script
- *      def gp = new GProperties(true)
+ *      def gp = new GProperties()
  *      
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
- *      assert '{groovy.greeting},{some.name} in ${new 
java.text.SimpleDateFormat('yyyyMMdd').format(new Date())}' == 
gp.getProperty('greeting.daniel')
+ *      assert '{groovy.greeting},{some.name}' == 
gp.getProperty('greeting.daniel')
  * </pre>
  *
  * @since 3.0.0
@@ -85,63 +74,46 @@ import java.util.regex.Pattern
 class GProperties extends Properties {
     private static final long serialVersionUID = 6112578636029876860L
     public static final String IMPORT_PROPERTIES_KEY = 'import.properties'
-    public static final String VAR_KEY = 'key'
-    public static final String VAR_PROPERTIES = 'properties'
-    private static final Pattern GROOVY_SCRIPT_PATTERN = 
Pattern.compile(/[$][{]\s*(.+?)\s*[}]/)
-    private static final Pattern INTERPOLATE_PATTERN = 
Pattern.compile(/[{]\s*(.+?)\s*[}]/)
+    private static final Pattern INTERPOLATE_PATTERN = 
Pattern.compile(/[{](.+?)[}]/)
     private static final Pattern ESCAPE_PATTERN = 
Pattern.compile(/[{]([{].+?[}])[}]/)
     private static final String LEFT_CURLY_BRACE = '{'
     private static final String RIGHT_CURLY_BRACE = '}'
     private static final String COMMA = ','
-    private final boolean evaluateScriptEnabled
-    private final GroovyShell groovyShell
-    private final List<GProperties> importPropertiesList = new ArrayList<>()
+    private final List<GProperties> importPropertiesList = new LinkedList<>()
 
-    GProperties(boolean evaluateScriptEnabled=false, GroovyShell 
groovyShell=new GroovyShell()) {
-        this(null, evaluateScriptEnabled, groovyShell)
+    GProperties() {
+        this(null)
     }
 
-    GProperties(Properties defaults, boolean evaluateScriptEnabled=false, 
GroovyShell groovyShell=new GroovyShell()) {
+    GProperties(Properties defaults) {
         super(defaults)
-        this.evaluateScriptEnabled = evaluateScriptEnabled
-        this.groovyShell = groovyShell
     }
 
     @Override
     String getProperty(String key) {
         String value = super.getProperty(key)
 
-        if (!value) {
+        if (null == value) {
             for (GProperties importProperties : importPropertiesList) {
                 value = importProperties.getProperty(key)
 
-                if (value) {
+                if (null != value) {
                     break
                 }
             }
         }
 
-        if (!value) {
+        if (null == value) {
             return value
         }
 
-        if (evaluateScriptEnabled) {
-            value = value.replaceAll(GROOVY_SCRIPT_PATTERN) { String _0, 
String _1 ->
-                if (_1.startsWith(LEFT_CURLY_BRACE) && 
_1.endsWith(RIGHT_CURLY_BRACE)) {
-                    return _0
-                }
-                processImplicitVariables(key) {
-                    groovyShell.evaluate(_1)
-                }
-            }
-        }
-
         value = value.replaceAll(INTERPOLATE_PATTERN) { String _0, String _1 ->
             if (_1.startsWith(LEFT_CURLY_BRACE) && 
_1.endsWith(RIGHT_CURLY_BRACE)) {
                 return _0
             }
 
-            this.getProperty(_1) ?: _0
+            def p = this.getProperty(_1.trim())
+            null == p ? _0 : p
         }
 
         value.replaceAll(ESCAPE_PATTERN) { String _0, String _1 ->
@@ -191,14 +163,4 @@ class GProperties extends Properties {
             importPropertiesList << importProperties
         }
     }
-
-    private synchronized Object processImplicitVariables(String key, Closure 
c) {
-        groovyShell.setVariable(VAR_KEY, key)
-        groovyShell.setVariable(VAR_PROPERTIES, this)
-        def v = c()
-        groovyShell.removeVariable(VAR_PROPERTIES)
-        groovyShell.removeVariable(VAR_KEY)
-
-        return v
-    }
 }

http://git-wip-us.apache.org/repos/asf/groovy/blob/1d20e307/src/test-resources/groovy/util/gproperties.properties
----------------------------------------------------------------------
diff --git a/src/test-resources/groovy/util/gproperties.properties 
b/src/test-resources/groovy/util/gproperties.properties
index e4f488d..f7f7db3 100644
--- a/src/test-resources/groovy/util/gproperties.properties
+++ b/src/test-resources/groovy/util/gproperties.properties
@@ -20,9 +20,5 @@
 
import.properties=/groovy/util/gproperties_import.properties,/groovy/util/gproperties_import3.properties
 groovy.greeting={greeting.word},{some.name}
 groovy.greeting.with.smile={groovy.greeting} :)
-groovy.greeting.with.time={groovy.greeting.with.smile} in ${new 
java.text.SimpleDateFormat('yyyyMMdd').format(new Date())}
 groovy.greeting.with.missing=Hello,{none} {0}
-groovy.greeting.with.script=Hello,${properties.getProperty('some.name')}
-groovy.greeting.with.key=Hello,${key}
-groovy.greeting.with.escapes=Hello,{{some.name}}
-groovy.greeting.with.escapes2=Hello,${{properties.getProperty('some.name')}}
\ No newline at end of file
+groovy.greeting.with.escapes=Hello,{{some.name}}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/groovy/blob/1d20e307/src/test-resources/groovy/util/gproperties_import2.properties
----------------------------------------------------------------------
diff --git a/src/test-resources/groovy/util/gproperties_import2.properties 
b/src/test-resources/groovy/util/gproperties_import2.properties
index 7d41c9f..99a9f7a 100644
--- a/src/test-resources/groovy/util/gproperties_import2.properties
+++ b/src/test-resources/groovy/util/gproperties_import2.properties
@@ -17,4 +17,4 @@
 #  under the License.
 #
 
-greeting.word=H${'ell'}o
+greeting.word=Hello

http://git-wip-us.apache.org/repos/asf/groovy/blob/1d20e307/src/test/groovy/util/GPropertiesTest.groovy
----------------------------------------------------------------------
diff --git a/src/test/groovy/util/GPropertiesTest.groovy 
b/src/test/groovy/util/GPropertiesTest.groovy
index fe9ae0d..8967d66 100644
--- a/src/test/groovy/util/GPropertiesTest.groovy
+++ b/src/test/groovy/util/GPropertiesTest.groovy
@@ -20,7 +20,7 @@ package groovy.util
 
 class GPropertiesTest extends GroovyTestCase {
     void testImportProperties() {
-        def gp = new GProperties(true)
+        def gp = new GProperties()
         
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
 
         assert 
'/groovy/util/gproperties_import.properties,/groovy/util/gproperties_import3.properties'
 == gp.getProperty('import.properties')
@@ -30,14 +30,14 @@ class GPropertiesTest extends GroovyTestCase {
     }
 
     void testInterpolate() {
-        def gp = new GProperties(true)
+        def gp = new GProperties()
         
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
 
         assert 'Hello,Daniel' == gp.getProperty('groovy.greeting')
     }
 
     void testInterpolate2() {
-        def gp = new GProperties(true)
+        def gp = new GProperties()
         
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
 
         assert 'Hello,Daniel :)' == 
gp.getProperty('groovy.greeting.with.smile')
@@ -51,7 +51,7 @@ class GPropertiesTest extends GroovyTestCase {
     }
 
     void testInterpolate4() {
-        def gp = new GProperties(true)
+        def gp = new GProperties()
         
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
 
         assert 'Hello,Daniel' == gp.getProperty('greeting.daniel')
@@ -61,7 +61,7 @@ class GPropertiesTest extends GroovyTestCase {
         def gp = new GProperties()
         
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
 
-        assert '''H${'ell'}o,Daniel''' == gp.getProperty('greeting.daniel')
+        assert '''Hello,Daniel''' == gp.getProperty('greeting.daniel')
     }
 
     void testEscape() {
@@ -70,32 +70,4 @@ class GPropertiesTest extends GroovyTestCase {
 
         assert 'Hello,{some.name}' == 
gp.getProperty('groovy.greeting.with.escapes')
     }
-
-    void testEscape2() {
-        def gp = new GProperties()
-        
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
-
-        assert '''Hello,${properties.getProperty('some.name')}''' == 
gp.getProperty('groovy.greeting.with.escapes2')
-    }
-
-    void testInterpolateGroovyScript() {
-        def gp = new GProperties(true)
-        
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
-
-        assert "Hello,Daniel :) in ${new 
java.text.SimpleDateFormat('yyyyMMdd').format(new Date())}" == 
gp.getProperty('groovy.greeting.with.time')
-    }
-
-    void testInterpolateGroovyScript2() {
-        def gp = new GProperties(true)
-        
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
-
-        assert "Hello,Daniel" == gp.getProperty('groovy.greeting.with.script')
-    }
-
-    void testInterpolateGroovyScript3() {
-        def gp = new GProperties(true)
-        
gp.load(GPropertiesTest.getResourceAsStream('/groovy/util/gproperties.properties'))
-
-        assert "Hello,groovy.greeting.with.key" == 
gp.getProperty('groovy.greeting.with.key')
-    }
 }

Reply via email to