(groovy) 02/03: GROOVY-12346: place groovy -l with the interactive tools, not beside a service

[pa...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

paulk-asert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git

commit ab52fbd6c47da0ab61aa074fd93e60df55db717d
Author: Paul King <pa...@asert.com.au>
AuthorDate: Thu Sep 3 13:32:20 2026 +1000

    GROOVY-12346: place groovy -l with the interactive tools, not beside a service
    
    The listener was described as an exception to Groovy not being deployed as
    a network service, which promoted it into the category it does not belong
    to. It is an interactive developer tool of the groovysh and groovyConsole
    family whose input channel happens to be a socket rather than a terminal,
    and binding loopback is what keeps its trust posture the same as theirs:
    input comes from the local machine.
    
    §2 therefore carries it in the interactive tools row instead of a preamble
    about exceptions, and §9 states the character beside its siblings in the
    false-friends table, where a reader looks to find out what something is
    not.
    
    §12 is restored as a live tripwire. It asks whether a tool accepts input
    over the network *as a service*, and a loopback-bound developer tool does
    not meet that, so recording the condition as already met overstated what
    had changed and spent a tripwire that should still be watching. It now
    says why groovy -l falls short of it and what would clear it.
    
    The command-line documentation says what the option is for before it says
    how it works.
---
 THREAT_MODEL.md                | 2 +-
 src/spec/doc/tools-groovy.adoc | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 0ea7d3f913..47fa27359f 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -539,7 +539,7 @@ Groovy does **not** claim, and you must not assume, any of the following.
 | `@ThreadInterrupt` / `@TimedInterrupt` / `@ConditionInterrupt` | Cooperative interruption checks woven into loops/methods to tame *runaway* (buggy) scripts | Cooperative and removable by the code being run; no defense against deliberately malicious scripts. |
 | `@CompileStatic` / `@TypeChecked` | Compile-time type checking for correctness and performance | Not a security control; statically-compiled code is exactly as privileged. |
 | `groovy.sql.Sql` (beyond P1) | Convenience SQL access | Only the GString/bind forms parameterize. A `String` you concatenate yourself, dynamic identifiers via `Sql.expand`, or `DataSet` table/column names, are **not** protected (CWE-89). |
-| The Groovy "shell"/console tools | Developer/operator conveniences | `groovysh`/`groovyConsole` run code with the user's full privileges; they are not multi-tenant or sandboxed. `groovy -l` is the same kind of tool with a socket for an input channel instead of a terminal &mdash; an aid to experimenting with a line-driven script, not an application server. |
+| The Groovy "shell"/console tools | Developer/operator conveniences | `groovysh`/`groovyConsole` run code with the user's full privileges; they are not multi-tenant or sandboxed. `groovy -l` is the same kind of tool with a socket for an input channel instead of a terminal &mdash; an aid to experimenting with a line-driven script, not an application server. Deploying either as though it were is a choice with consequences ([§10](#10-downstream-responsibilities)). |
 | `JmxBuilder` connector servers | A development and experimentation aid | Every connector security property was assembled and discarded from 2008 until 2026, so no configuration produced a secured connector in that window and none can have been relied upon. It exposes an MBean server rather than being a managed service, and authenticates nobody unless told to. |
 
 Well-known attack classes Groovy does **not** defend against on the
diff --git a/src/spec/doc/tools-groovy.adoc b/src/spec/doc/tools-groovy.adoc
index c37e7fa32b..6c78f526c0 100644
--- a/src/spec/doc/tools-groovy.adoc
+++ b/src/spec/doc/tools-groovy.adoc
@@ -62,7 +62,11 @@ int (disable any int based optimizations) |
 | -pr | --enable-preview | Enable preview Java features (jdk12+ only). | groovy --enable-preview Person.groovy
 |=======================================================================
 
-The `-l` option runs the given script once for every line a client sends, with the
+The `-l` option is a developer convenience for experimenting with a line-driven
+script, in the same spirit as `groovysh` but reading from a socket instead of a
+terminal. It is not an application server.
+
+It runs the given script once for every line a client sends, with the
 line available as the implicit `line` variable and the connection as `out` and
 `socket`. The listening socket is bound to the loopback address, so only clients on
 the same machine can connect. Supply a host to listen more widely -- `0.0.0.0:1960`