github-advanced-security[bot] commented on code in PR #3109:
URL: https://github.com/apache/groovy/pull/3109#discussion_r4429508554
##########
src/main/java/groovy/lang/GroovyClassLoader.java:
##########
@@ -597,7 +607,135 @@
* @see #clearCache()
*/
protected void removeClassCacheEntry(final String name) {
- classCache.remove(name);
+ if (classCache.remove(name) != null) {
+ noteRemovedSimpleName(name);
+ }
+ }
+
+ /**
+ * Beans introspection and inner-class resolution ask for companion names
+ * that are not on any classpath. {@code Class.forName} of a beans
companion
+ * retries the platform loader when this loader reports
+ * {@link ClassNotFoundException}, so that probe is reported as a different
+ * exception the introspector already ignores. Other known misses stay a
+ * normal {@link ClassNotFoundException}, without consulting the parent.
+ * A {@code java.lang.$} name is not one of those misses: a parent loader
+ * can define it without exposing a class file here.
+ */
+ private void throwIfParentWouldOnlyRecordAMiss(final String name, final
boolean lookupScriptFiles) throws ClassNotFoundException {
+ if (name == null) {
+ return;
+ }
+ boolean beanCompanion = isBeanCompanionProbe(name);
+ boolean innerName = name.indexOf('$') >= 0;
+ if (!beanCompanion && !innerName) {
+ return;
+ }
+ // java.lang.$JaCoCo and similar helpers are real parent-defined types.
+ // Generated script and template names are not in this package.
+ if (!beanCompanion && name.startsWith("java.lang.$")) {
+ return;
+ }
+ if (definedByParentGroovyLoader(name) || hasClassResource(name)) {
+ return;
+ }
+ if (lookupScriptFiles) {
+ try {
+ if (resourceLoader.loadGroovySource(name) != null) {
+ return;
+ }
+ } catch (MalformedURLException ignored) {
+ // Let the normal load path report the bad source URL.
+ return;
+ }
+ }
+ if (beanCompanion) {
+ throw new IntrospectionProbeMiss(name);
+ }
+ throw new ClassNotFoundException(name);
+ }
+
+ private boolean hasClassResource(final String name) {
+ try {
+ return getResource(name.replace('.', '/') + ".class") != null;
Review Comment:
## CodeQL / Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/groovy/security/code-scanning/285)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
