Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-46327

GString map identifiers don't work in sandboxed Groovy code

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • script-security-plugin
    • None
    • Script Security 1.33

      The following code will fail in non-CPS-transformed sandboxed Groovy, but will pass in CPS-transformed-and-sandboxed Groovy or vanilla Groovy:

      def m = [fruitA: 'apple', fruitB: 'banana']
      
      def bKey = 'B'
      
      assert m."fruitB" == m."fruit${bKey}"

      That's obviously wrong. Not sure yet where the problem is happening but will dig.

          [JENKINS-46327] GString map identifiers don't work in sandboxed Groovy code

          Andrew Bayer added a comment -

          https://github.com/jenkinsci/script-security-plugin/pull/143 is an ongoing PR for adding more test coverage of the language as a whole, and includes a currently-ignored test for this bug.

          Andrew Bayer added a comment - https://github.com/jenkinsci/script-security-plugin/pull/143 is an ongoing PR for adding more test coverage of the language as a whole, and includes a currently-ignored test for this bug.

          Andrew Bayer added a comment - - edited

          EDIT: Whoops, I was completely wrong about this so ignore.

          Andrew Bayer added a comment - - edited EDIT: Whoops, I was completely wrong about this so ignore.

          Andrew Bayer added a comment -

          Alrightie, I think this time I didn't get everything completely wrong. =) It looks like what's happening is that it's calling map.get(GStringImpl) rather than map.get(String) - i.e., it's not coercing the gstring to a string. I think this may be specific to the quoted identifier approach rather than a literal get call, but not sure yet.

          Andrew Bayer added a comment - Alrightie, I think this time I didn't get everything completely wrong. =) It looks like what's happening is that it's calling map.get(GStringImpl) rather than map.get(String) - i.e., it's not coercing the gstring to a string. I think this may be specific to the quoted identifier approach rather than a literal get call, but not sure yet.

          Andrew Bayer added a comment -

          Nope, not just quoted identifiers - map.get("fruit${bKey}") has the same problem. I think I need to look into what exactly the call site logic is for coercing gstrings to strings in Groovy proper.

          Andrew Bayer added a comment - Nope, not just quoted identifiers - map.get("fruit${bKey}") has the same problem. I think I need to look into what exactly the call site logic is for coercing gstrings to strings in Groovy proper.

            Unassigned Unassigned
            abayer Andrew Bayer
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: