问题:

I am wondering how one can attack the problem of denying *.groovy files the ability to reference and make use of certain classes that i pick. One approach is of course to install a security manager and classloader to block attempts toload or execute certain methods on certain classes eg java.io.File. This however of course from what i can imagine not affect interpretted mode as no class is ever generatd or loaded by the classloader.

Ideally i would like the equivalent of class verifying but for groovy files during the parsing phase and similar evaluations are executed.

Any pointers would be appreciated.

回答1:

Not sure, but I believe the SecureASTCustomizer might help you (Groovy 1.8)

There is a blog post by Cedric Champeau which shows how it is used. Basically, you can set up a blacklist or whitelist of classes, imports, operators, etc that a script is allowed to use. Or indeed you can set more complex rules (see the examples on the blog post about debying variable names that start with a caps char, or denying the use of System.exit)