Skip to content

Add StringGroovyMethods/DefaultGroovyMethods replaceFirst to whitelist entries #907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ugrave wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add StringGroovyMethods/DefaultGroovyMethods replaceFirst to whitelist entries #907

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
955e44f
Add StringGroovyMethods/DefaultGroovyMethods replaceFirst to whitelis…
ugrave Jan 21, 2026
2b3420c
Sort entries
ugrave Jan 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/main/resources/org/jenkinsci/plugins/scriptsecurity/sandbox/whitelists/generic-whitelist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1166,6 +1166,13 @@ staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAll java.util.M
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAt java.util.List int java.lang.Object
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAt java.util.Map java.lang.Object java.lang.Object
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods removeAll java.util.Collection groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.CharSequence java.lang.CharSequence groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.CharSequence java.lang.CharSequence java.lang.CharSequence
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.CharSequence java.util.regex.Pattern groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.CharSequence java.util.regex.Pattern java.lang.CharSequence
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.String java.lang.String groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.String java.util.regex.Pattern groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.String java.util.regex.Pattern java.lang.String
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods retainAll java.util.Collection groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods reverse java.util.Iterator
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods reverse java.util.List
Expand Down Expand Up @@ -1383,9 +1390,12 @@ staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceAll java.lan
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceAll java.lang.String java.util.regex.Pattern groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceAll java.lang.String java.util.regex.Pattern java.lang.String
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.CharSequence java.lang.CharSequence groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.CharSequence java.lang.CharSequence java.lang.CharSequence
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.CharSequence java.util.regex.Pattern groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.CharSequence java.util.regex.Pattern java.lang.CharSequence
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.String java.lang.String groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.String java.util.regex.Pattern groovy.lang.Closure
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods replaceFirst java.lang.String java.util.regex.Pattern java.lang.String
Copy link
Member

@jglick jglick Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/apache/groovy/blob/41b990d0a20e442f29247f0e04cbed900f3dcad4/src/main/org/codehaus/groovy/runtime/StringGroovyMethods.java#L2730 This overload is deprecated. (May be true of others, I did not check yet.) Does the sandbox actually check this one specifically when you write e.g.

'xxx'.replaceFirst(/x/, 'y')

or would it use the CharSequence overload? Could check in e.g.

script-security-plugin/src/test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/whitelists/GenericWhitelistTest.java

Line 34 in c6ff4ef

public class GenericWhitelistTest {
even if the result is not committed.

Copy link
Author

@ugrave ugrave Jan 23, 2026 •
edited by jglick
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes i also saw it that the string is depreicated. But in my test is using the string overload and not the CharSequence overload.

I did a test with all replaceFirst whiliste removed for String, StringGroovyMethods and DefaultGroovyMethods
An get different results depending of the replaceFirst is used:

  • 'xxx'.replaceFirst(/x/, 'y'): Scripts not permitted to use method java.lang.String replaceFirst java.lang.String java.lang.String
  • 'xxx'.replaceFirst(~/x/, 'y'): Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods replaceFirst java.lang.String java.util.regex.Pattern java.lang.String

Nut sure when this StringGroovyMethod is used. In my case its using always the DefaultGroovyMethods or from String itself. (maybe because String itself has also now a replaceFirst method)

staticMethod org.codehaus.groovy.runtime.StringGroovyMethods reverse java.lang.String
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods startsWithAny java.lang.CharSequence java.lang.CharSequence[]
staticMethod org.codehaus.groovy.runtime.StringGroovyMethods takeWhile groovy.lang.GString groovy.lang.Closure
Expand Down
Loading