You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@groovy.apache.org by "Paul King (Jira)" <ji...@apache.org> on 2026/09/17 07:27:00 UTC

[jira] [Commented] (GROOVY-12414) Run groovy scripts in a sandboxed mode

    [ https://issues.apache.org/jira/browse/GROOVY-12414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116255#comment-18116255 ] 

Paul King commented on GROOVY-12414:
------------------------------------

I presume you know about the SecureASTCustomizer which can be used to stop accidental casual usage of most of those APIs but isn't a sandbox.

For a sandbox, have you seen the recent discussion on the users mailing list:
https://lists.apache.org/thread/4xzsnoy87743qmvw9g5856drsrxg9xh7

Nothing resolved yet but some discussions.

> Run groovy scripts in a sandboxed mode
> --------------------------------------
>
>                 Key: GROOVY-12414
>                 URL: https://issues.apache.org/jira/browse/GROOVY-12414
>             Project: Groovy
>          Issue Type: New Feature
>            Reporter: Nils Renaud
>            Priority: Minor
>
> I own an application extensible through Groovy scripts and 99% of my users only have to take an object as input, perform some transformations and return another object.
> They don't need to access the fileSystem, nor execute commands on the machine, nor access the network (for example).
>  
> Would you consider adding an option to the `GroovyScriptEngine` to block such potentially dangerous calls ?
> We could even set a custom `FileSystem` implementation as the only accessible one from the script to introduce finer access rules.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)