Potential code injection when using GroovyShell

Docs > Code Analysis > Static Analysis Rules > Potential code injection when using GroovyShell

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: java-security/groovyshell-code-injection

Language: Java

Severity: Warning

Category: Security

CWE: 94

Description

An expression for GroovyScript is built with a dynamic value. The source should be checked and filtered to prevent any user-input from the script.

Learn More

Non-Compliant Code Examples

class MyClass {

    public void evaluateScript(String script) {
        GroovyShell shell = new GroovyShell();
        shell.evaluate(script);

        foo = shell.evaluate(script);

        shell.evaluate("foo" + script);
        shell.evaluate(script + "foo");
    }
}

Compliant Code Examples

class MyClass {

    public void evaluateScript(String script) {
        GroovyShell shell = new GroovyShell();
        shell.evaluate(checkScript(script));
    }
}