How to secure scripting with JSR 223?

Question

I use Groovy as dynamic script engine to allow admin users of my web application to create little scripts as part of an interface solution, eg. do simple string operations, tokenize and so on.
Unfortunately that opens quite a big loophole because per default the script engine would execute anything.
I described a demo app here: http://javadude.wordpress.com/2011/06/29/creating-a-zk-groovy-console/

Object value = shell.evaluate("whatever groovy script");

You can execute System.exit(0) which shuts down the AS or even shell commands like "ls -l".execute().text or just snoop around system settings println InetAddress.localHost.hostAddress

I could do a string check before executing, like filter for System.xyz or execute.xyz

Any experience or recipes?

Thanks
Sven

Answer 1

With groovy 1.8, you can customize the compiler configuration

There's a blog post here which explains more:

http://www.jroller.com/melix/entry/customizing_groovy_compilation_process