Allow using Groovy scripts without Programming Rights

Why not simply create a Security Manager?
http://java.sun.com/j2se/1.5.0/docs/api/java/lang/SecurityManager.html

Because a Security Manager will not apply only on script but also on what script is calling

What do we want to protect:

• no file access (this should be the default - we need to fix all places where we use files)
• calls to privileged apis must check for programming rights (checks done at the java api level)

Anything else to protect?

• Do we want to forbid using reflection and constructing classes using Class.forName or ClassLoader?
• Do we want to forbid using Threads?

calls to System.*

• We need to protect against calling java libs, i.e. anything not in the JDK (users must only use the variables bound in the script context)
• no Threads
• no Reflection to create objects

Pointers for implementation (from Guillaume Laforge):

• Check "Secure AST Customizer" (avail on Slideshare)
• https://github.com/groovy/groovy-core/blob/master/src/examples/groovyShell/ArithmeticShell.groovy
• https://github.com/groovy/groovy-core/blob/master/src/examples/groovyShell/ArithmeticShellTest.groovy
• Useful customizer: Import Customizer would allow to inject imports so that we can automatically inject xwiki imports by default
• https://github.com/groovy/groovy-core/blob/master/src/test/org/codehaus/groovy/control/customizers/ImportCustomizerTest.groovy
• Pass CompilerConfiguration to our GroovyClassLoader instance
• AST Transformation Customizer allows to inject AST transformations. Would allow us to inject @TimedInterrupt, @Threadinterrupt or @CustomInterrupt (allow to stop a script execution after a certain time, after the thread is interrupted or use our own criteria).

We're getting closer!

See XCOMMONS-153 and XWIKI-7755

Start of a very first implementation done as part of XWIKI-7759

We can list stuff we want to forbid:

• Executing System.exit() Actually best might be to forbid calling all System methods.
• No file access
• Don't create Threads
• Forbid calling non JDK libs, including XWiki libs.
• etc...

But I think it's much better to list things we want to allow (whitelist) since it's safer:

• XWiki APIs:
  • com.xpn.xwiki.api package
  • Script Services are bound in the context so no need to have any rule on that
• java.lang

And then slowly add more safe stuff when the use cases are found. I'm going to start with this.

First version done! It's very basic ATM and allows almost nothing... We'll work on it progressively from now on to slowly open up allowed stuff.

To use this:

• Add in xwiki.properties:

  groovy.compilationCustomizers=secure
  

Documented at http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Configuration#HSecuringGroovyScripts