Skip to content
Permalink
Browse files
Merge pull request #156 from jglick/superCallsSandboxed
[JENKINS-42563] Demonstrate that super calls run through the sandbox interceptor
  • Loading branch information
jglick committed Jul 25, 2017
2 parents b476ea4 + 0c9138d commit bcca2269e873dc4c9ef353b02ddec7f171dcdb12
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 1 deletion.
@@ -93,7 +93,7 @@
<dependency>
<groupId>org.jenkins-ci.plugins</groupId>
<artifactId>script-security</artifactId>
<version>1.29</version>
<version>1.30</version>
</dependency>
<dependency>
<groupId>org.jenkins-ci.plugins</groupId>
@@ -77,6 +77,18 @@ public class CpsFlowDefinition2Test extends AbstractCpsFlowTest {
jenkins.configRoundtrip(job);
}

@Issue("JENKINS-42563")
@Test
public void superCallsSandboxed() throws Exception {
WorkflowJob job = jenkins.jenkins.createProject(WorkflowJob.class, "p");
job.setDefinition(new CpsFlowDefinition("class X extends groovy.json.JsonSlurper {def parse(url) {super.parse(new URL(url))}}; echo(/got ${new X().parse(\"${JENKINS_URL}api/json\")}/)", true));
WorkflowRun r = jenkins.assertBuildStatus(Result.FAILURE, job.scheduleBuild2(0).get());
jenkins.assertLogContains("org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method groovy.json.JsonSlurper parse java.net.URL", r);
job.setDefinition(new CpsFlowDefinition("class X extends groovy.json.JsonSlurper {def m(url) {super.parse(new URL(url))}}; echo(/got ${new X().m(\"${JENKINS_URL}api/json\")}/)", true));
r = jenkins.assertBuildStatus(Result.FAILURE, job.scheduleBuild2(0).get());
jenkins.assertLogContains("org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method groovy.json.JsonSlurper parse java.net.URL", r);
}

@Test
public void sandboxInvokerUsed() throws Exception {
WorkflowJob job = jenkins.jenkins.createProject(WorkflowJob.class, "p");

0 comments on commit bcca226

Please sign in to comment.