preventing usage of bean and message fields in script

Zomis · Jun 23, 2015 · b4f949f · b4f949f
1 parent 2b2c008
commit b4f949f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/src/main/groovy/net/zomis/duga/tasks/ChatCommandDelegate.groovy b/src/main/groovy/net/zomis/duga/tasks/ChatCommandDelegate.groovy
@@ -10,6 +10,7 @@ import net.zomis.duga.chat.WebhookParameters
  */
 abstract class ChatCommandDelegate extends Script {
 
+    // DO NOT RENAME THESE FIELDS. Their names are denied through hardcoding
     private ChatMessageIncoming message
     private DugaChatListener bean
 

diff --git a/src/main/groovy/net/zomis/duga/tasks/ListenTask.groovy b/src/main/groovy/net/zomis/duga/tasks/ListenTask.groovy
@@ -11,6 +11,8 @@ import net.zomis.duga.ChatCommands
 import net.zomis.duga.DugaBot
 import net.zomis.duga.DugaChatListener
 import net.zomis.duga.chat.WebhookParameters
+import org.codehaus.groovy.ast.expr.Expression
+import org.codehaus.groovy.ast.expr.VariableExpression
 import org.codehaus.groovy.control.CompilerConfiguration
 import org.codehaus.groovy.control.customizers.ASTTransformationCustomizer
 import org.codehaus.groovy.control.customizers.SecureASTCustomizer
@@ -89,6 +91,17 @@ class ListenTask implements Runnable {
                     BigDecimal
             ].asImmutable()
         }
+        scz.addExpressionCheckers(new SecureASTCustomizer.ExpressionChecker() {
+            @Override
+            boolean isAuthorized(Expression expression) {
+                if (expression instanceof VariableExpression) {
+                    VariableExpression expr = (VariableExpression) expression
+                    return expr.name != 'bean' && expr.name != 'message'
+                }
+                return true
+            }
+        })
+
         cc.addCompilationCustomizers(scz)
         def compileStaticCustomizer = new ASTTransformationCustomizer(Collections.singletonMap('extensions',
             Collections.singletonList('typecheck-extension.groovy')), CompileStatic.class)