[
https://issues.apache.org/jira/browse/GROOVY-12346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110935#comment-18110935
]
ASF GitHub Bot commented on GROOVY-12346:
-----------------------------------------
paulk-asert opened a new pull request, #2869:
URL: https://github.com/apache/groovy/pull/2869
…wise
GroovySocketServer called new ServerSocket(port), which binds every
interface, and the CLI had no way to say otherwise, so any peer able to reach
the port could feed lines to the operator's script. The listener now binds the
loopback address, and -l accepts an optional host to widen it deliberately:
groovy -l 1960 # 127.0.0.1:1960
groovy -l 0.0.0.0:1960 # every interface, and says so
groovy -l [::1]:1960 # IPv6 literals are bracketed
A new public constructor takes an InetSocketAddress, so an embedder can
still choose the interface; the constructors taking a port bind loopback.
The startup banner reported InetAddress.getLocalHost() while the socket
listened everywhere, naming one address it was not confined to. It now names
what was actually bound, and warns when that reaches other hosts. The URL field
it was built from is gone: it existed only to carry a port, and getLocalHost()
throws UnknownHostException on a host whose name does not resolve, which left
the field null and turned the next line into an NPE inside a catch-and-print.
THREAT_MODEL gains the peer as an adversary. It is the data supplier of §7
reached over a socket Groovy opened rather than through an embedding
application, and it carries no further capability: a line arrives as the `line`
binding and is never evaluated as code. §9 records that the listener
authenticates nobody and does not encrypt, §10 that an operator who widens it
owns the exposure, and §12 that this condition has now been met once rather
than remaining hypothetical.
Adds the first tests for GroovySocketServer. They exercise address parsing
rather than a running server, whose accept loop holds a non-daemon thread that
nothing can stop.
> Provide a GroovySocketServer constructor variant with an address
> ----------------------------------------------------------------
>
> Key: GROOVY-12346
> URL: https://issues.apache.org/jira/browse/GROOVY-12346
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Assignee: Paul King
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
