add security to scripts by whitelisting the imports

jsyntrax/src/main/java/org/atpfivt/jsyntrax/groovy_parser/Parser.groovy

@@ -4,6 +4,7 @@ import org.atpfivt.jsyntrax.Configuration
 import org.atpfivt.jsyntrax.units.Unit
 import org.codehaus.groovy.control.CompilationFailedException
 import org.codehaus.groovy.control.CompilerConfiguration
+import org.codehaus.groovy.control.customizers.SecureASTCustomizer
 
 class Parser {
 
@@ -13,8 +14,15 @@ class Parser {
 
     Parser(String scriptText) throws CompilationFailedException {
         this.scriptText = scriptText
+        final SecureASTCustomizer secure = new SecureASTCustomizer()
+        secure.with {
+            indirectImportCheckEnabled = true
+
+            importsWhitelist = ['java.lang.Object']
+        }
         def config = new CompilerConfiguration()
         config.setScriptBaseClass(SyntraxScript.class.name)
+        config.addCompilationCustomizers(secure)
         def sharedData = new Binding()
         def shell = new GroovyShell(this.class.classLoader, sharedData, config)
         shell.setVariable("None", null)

jsyntrax/src/test/java/org/atpfivt/jsyntrax/MainTest.java

@@ -125,6 +125,24 @@ void testPngByDefault() throws IOException, URISyntaxException {
         }
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "sysexit.spec",
+            "sysexitreflection.spec"})
+    void testSysexitNotAllowed(String filename) throws URISyntaxException, IOException {
+        Path inputPath = Paths.get(MainTest.class.getResource(filename).toURI());
+        ByteArrayOutputStream outContent = new ByteArrayOutputStream();
+        PrintStream originalOut = System.out;
+        try {
+            System.setOut(new PrintStream(outContent));
+            Main.main(inputPath.toString());
+            assertTrue(outContent.toString().contains("Something is wrong with input script"));
+        } finally {
+            System.setOut(originalOut);
+            System.out.println(outContent);
+        }
+    }
+
 
     private static void validatePng(byte[] png) {
         //check for png header
@@ -137,6 +155,7 @@ private static void validatePng(byte[] png) {
     private static void validateSVG(String svg) {
         assertTrue(svg.startsWith("<?xml"));
         assertTrue(svg.contains("JSYNTRAX"));
+        assertTrue(svg.contains("diagram title"));
         assertTrue(svg.contains("href=\"https://github.com/atp-mipt/jsyntrax\""));
     }
 }

jsyntrax/src/test/resources/org/atpfivt/jsyntrax/jsyntrax.spec

@@ -1 +1,3 @@
+title('diagram title')
 jsyntrax(optx('JSYNTRAX'), ['JSYNTRAX': 'https://github.com/atp-mipt/jsyntrax'])
+

jsyntrax/src/test/resources/org/atpfivt/jsyntrax/sysexit.spec

@@ -0,0 +1 @@
+System.exit(42)

jsyntrax/src/test/resources/org/atpfivt/jsyntrax/sysexitreflection.spec

@@ -0,0 +1,3 @@
+def systemClass = Class.forName("java.lang.System")
+def exitMethod = systemClass.getDeclaredMethod("exit", Integer.TYPE)
+exitMethod.invoke(null, 0)