[JIRA] [script-security-plugin] (JENKINS-28586) Method access/properties inside Closure

[k...@kohsuke.org (JIRA)]

Title: Message Title

Kohsuke Kawaguchi created an issue   Jenkins / JENKINS-28586 Method access/properties inside Closure Issue Type: Improvement Assignee: Kohsuke Kawaguchi Components: script-security-plugin Created: 26/May/15 10:47 PM Priority: Major Reporter: Kohsuke Kawaguchi Consider a closure attempts to call methods/properties like the following: class Foo { def foo() {} } def c = { -> foo(); } c.delegate = new Foo(); c(); script-security currently tries to check the access at GroovyObject.invokeMethod. For example, the above would be rejected like this: org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method groovy.lang.GroovyObject invokeMethod java.lang.String java.lang.Object (Script1$_run_closure1 foo) This is hardly useful, because GroovyObject.invokeMethod is too generic to whitelist. It's much more sensible to figure out where this call is actually handled (in this case Foo.foo, then check the access of the target (in the case above this would have been allowed via ClassLoaderWhitelist) Add Comment   This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.