GROOVY-11170: Fix edge cases for SecureASTCustomizer (test cases)

apache · Sep 11, 2023 · ef238e1 · ef238e1
1 parent 5e8e09f
commit ef238e1
Showing 1 changed file with 56 additions and 0 deletions.
diff --git a/src/test/org/codehaus/groovy/control/customizers/SecureASTCustomizerTest.groovy b/src/test/org/codehaus/groovy/control/customizers/SecureASTCustomizerTest.groovy
@@ -525,6 +525,62 @@ final class SecureASTCustomizerTest {
         }
     }
 
+    @Test
+    void testAllowedReceiversMethod() {
+        customizer.allowedReceiversClasses = [Integer.TYPE]
+        def shell = new GroovyShell(configuration)
+        shell.evaluate('''
+            static main(args) {
+                1.plus(1)
+            }
+        ''')
+        assert hasSecurityException {
+            shell.evaluate('''
+                static main(args) {
+                    "string".toUpperCase()
+                }
+            ''')
+        }
+        assert hasSecurityException {
+            shell.evaluate('''
+                static main(args) {
+                    2.0.multiply(4)
+                }
+            ''')
+        }
+    }
+
+    @Test
+    void testAllowedReceiversClass() {
+        customizer.allowedReceiversClasses = [Integer.TYPE]
+        def shell = new GroovyShell(configuration)
+        shell.evaluate('''
+            class Dummy {
+                static main(args) {
+                    1.plus(1)
+                }
+            }
+        ''')
+        assert hasSecurityException {
+            shell.evaluate('''
+                class Dummy {
+                    static main(args) {
+                        "string".toUpperCase()
+                    }
+                }
+            ''')
+        }
+        assert hasSecurityException {
+            shell.evaluate('''
+                class Dummy {
+                    static main(args) {
+                        2.0.multiply(4)
+                    }
+                }
+            ''')
+        }
+    }
+
     @Test
     void testDisallowedReceivers() {
         customizer.disallowedReceiversClasses = [String]