in src/main/groovy/groovyShell/BlacklistingShell.groovy [61:95]
def evaluate(String text) {
try {
final SecureASTCustomizer secure = new SecureASTCustomizer()
secure.with {
receiversClassesBlackList = [
Object,
Script,
GroovyShell,
Eval,
System,
].asImmutable()
expressionsBlacklist = [MethodPointerExpression].asImmutable()
}
CompilerConfiguration config = new CompilerConfiguration()
config.addCompilationCustomizers(secure)
GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)
Class clazz = loader.parseClass(text)
Script script = (Script) clazz.newInstance();
Object result = script.run()
return result
} catch (SecurityException ex) {
throw new SecurityException("Could not evaluate script: $text", ex)
} catch (MultipleCompilationErrorsException mce) {
//this allows compilation errors to be seen by the user
mce.errorCollector.errors.each {
if (it instanceof ExceptionMessage && it.cause instanceof SecurityException) {
throw it.cause
}
}
throw mce
}
}