Skip to content
Permalink
Browse files

Merge pull request #134 from jenkinsci/MissingMethodException

[JENKINS-37129] unclassified method vs MethodMissingException
  • Loading branch information...
kohsuke committed Jul 19, 2017
2 parents 8197245 + 950c4f4 commit 1ff48ff222e6b2f659bfff8ac92399d4e31e6655
@@ -26,6 +26,7 @@

import groovy.lang.GroovyRuntimeException;
import groovy.lang.MetaMethod;
import groovy.lang.MissingMethodException;
import groovy.lang.MissingPropertyException;
import groovy.lang.Script;
import hudson.Functions;
@@ -110,7 +111,8 @@
return super.onMethodCall(invoker, receiver, method, args);
}

throw new RejectedAccessException("unclassified method " + EnumeratingWhitelist.getName(receiver.getClass()) + " " + method + printArgumentTypes(args));
// no such method exists
throw new MissingMethodException(method, receiver.getClass(), args);
} else if (whitelist.permitsMethod(m, receiver, args)) {
return super.onMethodCall(invoker, receiver, method, args);
} else if (method.equals("invokeMethod") && args.length == 2 && args[0] instanceof String && args[1] instanceof Object[]) {
@@ -24,10 +24,6 @@

package org.jenkinsci.plugins.scriptsecurity.sandbox.groovy;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import groovy.json.JsonBuilder;
import groovy.json.JsonDelegate;
import groovy.lang.GString;
@@ -37,6 +33,7 @@
import groovy.lang.GroovyShell;
import groovy.lang.GroovySystem;
import groovy.lang.MetaMethod;
import groovy.lang.MissingMethodException;
import groovy.lang.MissingPropertyException;
import groovy.lang.Script;
import groovy.text.SimpleTemplateEngine;
@@ -47,6 +44,7 @@
import java.lang.reflect.Method;
import java.net.URL;
import java.text.DateFormat;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.Date;
@@ -73,6 +71,9 @@
import org.junit.Test;
import org.jvnet.hudson.test.Issue;

import static org.hamcrest.CoreMatchers.*;
import static org.junit.Assert.*;

public class SandboxInterceptorTest {

@Test public void genericWhitelist() throws Exception {
@@ -709,4 +710,29 @@ public static void assertRejected(Whitelist whitelist, String expectedSignature,
}
}

@Issue("JENKINS-37129")
@Test public void methodMissingException() throws Exception {
// the case where the unsafe receiver type causes the security check to fail
try {
assertEvaluate(new GenericWhitelist(), "should fail", "[].noSuchMethod()");
} catch (MissingMethodException e) {
assertEquals(e.getType(),ArrayList.class);
assertThat(e.getMethod(),is("noSuchMethod"));
}

// trying to call an existing method that's not safe
try {
assertEvaluate(new GenericWhitelist(), "should fail", "[].class.classLoader");
} catch (RejectedAccessException e) {
assertEquals("method java.lang.Class getClassLoader", e.getSignature());
}

// the case where the safe receiver type causes the security check to pass
try {
assertEvaluate(new GenericWhitelist(), "should fail", "1.noSuchMethod()");
} catch (MissingMethodException e) {
assertEquals(e.getType(),Integer.class);
assertThat(e.getMethod(),is("noSuchMethod"));
}
}
}

0 comments on commit 1ff48ff

Please sign in to comment.
You can’t perform that action at this time.