Package org.codehaus.groovy.control.customizers

# Class SecureASTCustomizer

java.lang.Object
org.codehaus.groovy.control.customizers.CompilationCustomizer
org.codehaus.groovy.control.customizers.SecureASTCustomizer

All Implemented Interfaces:
  `CompilationUnit.IPrimaryClassNodeOperation`

public class SecureASTCustomizer extends CompilationCustomizer
Restricts the grammar available to the source being compiled, so that a shell or domain specific language (DSL) offers only a chosen subset of the Groovy language. For example, if you only want to allow arithmetic operations in a groovy shell, you can configure this customizer to restrict package imports, method calls and so on.

Despite its name, this customizer is not a sandbox and not a security boundary. It is a best-effort grammar lockdown: it cannot constrain what otherwise-permitted code does at runtime, its coverage of the source is deliberately partial (see Limitations below), and an author of the source being compiled can work around it. Accordingly, the Apache Groovy threat model treats it as a hardening aid rather than a security boundary (see its "security properties the project does NOT provide" section): a report that merely demonstrates a bypass is by design, not a vulnerability. If you must run partially-trusted scripts, layer real isolation outside the language, such as a separate process or JVM, an OS or container sandbox, least-privilege credentials and network egress controls, and treat this customizer as one layer within that, never the perimeter.

Most of the customization options found in this class work with either allowed or disallowed lists. This means that, for a single option, you can set an allowed list OR a disallowed list, but not both. You can mix allowed/disallowed strategies for different options. For example, you can have an allowed import list and a disallowed tokens list.

The recommended way of securing shells is to use allowed lists because it is guaranteed that future features of the Groovy language won't be accidentally allowed unless explicitly added to the allowed list. Using disallowed lists, you can limit the features of the language constructs supported by your shell by opting out, but new language features are then implicitly also available and this may not be desirable. The implication is that you might need to update your configuration with each new release.

The statement and expression lists are matched by exact class, so naming a class does not name its subclasses. Several language constructs are modelled as a subclass of another: a lambda is a `LambdaExpression`, which extends `ClosureExpression`; the `::` form of a method reference is a `MethodReferenceExpression`, which extends `MethodPointerExpression`; and attribute access is an `AttributeExpression`, which extends `PropertyExpression`. Each has to be listed in its own right. This is another reason to prefer allowed lists, which refuse an unlisted subclass rather than admitting one.

If neither an allowed list nor a disallowed list is set, then everything is permitted.

Combinations of import and star import constraints are authorized as long as you use the same type of list for both. For example, you may use an import allowed list and a star import allowed list together, but you cannot use an import allowed list with a star import disallowed list. Static imports are handled separately, meaning that disallowing an import does not prevent from allowing a static import.

Eventually, if the features provided here are not sufficient, you may implement custom AST filtering handlers, either implementing the `SecureASTCustomizer.StatementChecker` interface or `SecureASTCustomizer.ExpressionChecker` interface then register your handlers thanks to the `addExpressionCheckers(ExpressionChecker...)` and `addStatementCheckers(StatementChecker...)` methods.

Here is an example of usage. We will create a groovy classloader which only supports arithmetic operations and imports the `java.lang.Math` classes by default.

     final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
     final SecureASTCustomizer secure = new SecureASTCustomizer()
     secure.with {
         closuresAllowed = false
         methodDefinitionAllowed = false

         allowedImports = []
         allowedStaticImports = []
         allowedStaticStarImports = ['java.lang.Math'] // only java.lang.Math is allowed

         allowedTokens = [
                 PLUS,
                 MINUS,
                 MULTIPLY,
                 DIVIDE,
                 REMAINDER,
                 POWER,
                 PLUS_PLUS,
                 MINUS_MINUS,
                 COMPARE_EQUAL,
                 COMPARE_NOT_EQUAL,
                 COMPARE_LESS_THAN,
                 COMPARE_LESS_THAN_EQUAL,
                 COMPARE_GREATER_THAN,
                 COMPARE_GREATER_THAN_EQUAL,
         ].asImmutable()

         allowedConstantTypesClasses = [
                 Integer,
                 Float,
                 Long,
                 Double,
                 BigDecimal,
                 Integer.TYPE,
                 Long.TYPE,
                 Float.TYPE,
                 Double.TYPE
         ].asImmutable()

         allowedReceiversClasses = [
                 Math,
                 Integer,
                 Float,
                 Double,
                 Long,
                 BigDecimal
         ].asImmutable()
     }
     CompilerConfiguration config = new CompilerConfiguration()
     config.addCompilationCustomizers(imports, secure)
     GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)

Limitations. Coverage is partial by design, so it is worth knowing where the checks do and do not reach. This customizer visits the script statement block, method and constructor bodies, static and instance initializer blocks, and field initializer expressions. It does not visit the following, so restrictions such as `disallowedReceivers`, the statement and expression allowed/disallowed lists, and any registered `SecureASTCustomizer.StatementChecker` or `SecureASTCustomizer.ExpressionChecker` do not apply to code appearing there:

- annotation members, including closure arguments to annotations
- code carrying no source position, which is how constructors, initializers and fields added by the compiler or by an AST transformation are told apart from those written by the author of the source being secured

A generated member may still contain authored code, since a transformation can move it there — `@TupleConstructor(pre=...)` relocates the supplied closure body into the generated constructor, and `@ConditionalInterrupt` relocates its condition into a synthetic method — and such code keeps its source position, so it is checked wherever it was moved to.

Note that a constructor is not a "method definition" as far as `setMethodDefinitionAllowed(boolean)` is concerned: its body is checked, but declaring one remains permitted. Import restrictions apply to actual `import` statements, so they have no effect on a fully-qualified reference such as `new java.lang.ProcessBuilder(...)`. The `setIndirectImportCheckEnabled(boolean)` flag exists to catch some of those, but only within the code this customizer visits.

Where this customizer sits in the compilation explains both of the limitations above and one more. It runs at `CompilePhase.CANONICALIZATION`, which is after the phases in which annotations that execute have already done so, and before the phase in which types are inferred. So the type this customizer sees for an expression is the type the source states, and for anything left to the runtime that is `java.lang.Object`: in `def r = java.lang.Runtime; r.getRuntime()` the receiver of the call is `Object`, not `Runtime`, and a receiver list naming `Runtime` does not match it. Compiling statically does not change this, since `@CompileStatic` and `@TypeChecked` run at `CompilePhase.INSTRUCTION_SELECTION`, three phases later.

More fundamentally, compiling Groovy source is itself code execution, whether or not you subsequently run the result: global AST transforms found on the compile classpath, `@groovy.transform.ASTTest`, `@Grab` dependency resolution and static initializers all run during compilation, before and independently of any customizer you configure. Restricting the grammar of source that you nevertheless compile does not change this. When compiling source you do not fully trust, you should also set the `groovy.grape.enable` System property to false, keep the compile classpath under your control, and apply the out-of-language isolation described above.

For more information, please read:

- Improved sandboxing of Groovy scripts
- Oracle's Secure Coding Guidelines
- 10 Java security best practices
- Thirteen rules for developing secure Java applications
- 12 Java Security Best Practices

Since:
  1.8.0

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Class
  Description
  `static interface`
  `SecureASTCustomizer.ExpressionChecker`
  This interface allows the user to provide a custom expression checker if the dis/allowed expression lists are not sufficient
  `protected class`
  `SecureASTCustomizer.SecuringCodeVisitor`
  This visitor directly implements the `GroovyCodeVisitor` interface instead of using the `CodeVisitorSupport` class to make sure that future features of the language gets managed by this visitor.
  `static interface`
  `SecureASTCustomizer.StatementChecker`
  This interface allows the user to provide a custom statement checker if the dis/allowed statement lists are not sufficient

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `SecureASTCustomizer()`
  Creates a secure AST customizer that runs during canonicalization.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `void`
  `addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)`
  Adds expression checkers consulted in addition to the allow/disallow lists.
  `void`
  `addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)`
  Adds statement checkers consulted in addition to the allow/disallow lists.
  `protected void`
  `assertImportIsAllowed(String className)`
  Verifies that a regular import is allowed by the current configuration.
  `protected void`
  `assertStarImportIsAllowed(String packageName)`
  Verifies that a star import is allowed by the current configuration.
  `protected void`
  `assertStaticImportIsAllowed(String member, String className)`
  Verifies that a static import is allowed by the current configuration.
  `void`
  `call(SourceUnit source, GeneratorContext context, ClassNode classNode)`
  Verifies the configured security rules against the current source unit and class.
  `protected void`
  `checkMethodDefinitionAllowed(ClassNode owner)`
  Ensures the supplied class does not declare methods when such definitions are forbidden.
  `protected GroovyCodeVisitor`
  `createGroovyCodeVisitor()`
  Creates the visitor that enforces statement and expression restrictions.
  `protected static List<MethodNode>`
  `filterMethods(ClassNode owner)`
  Returns the non-synthetic methods declared directly by the supplied class.
  `List<String>`
  `getAllowedConstantTypes()`
  Returns the list of allowed constant or variable types.
  `List<Class<? extends Expression>>`
  `getAllowedExpressions()`
  Returns the list of allowed expression node types.
  `List<String>`
  `getAllowedImports()`
  Returns the list of explicitly allowed imports.
  `List<String>`
  `getAllowedReceivers()`
  Returns the list of receiver types on which calls are allowed.
  `List<String>`
  `getAllowedStarImports()`
  Returns the list of allowed star imports.
  `List<Class<? extends Statement>>`
  `getAllowedStatements()`
  Returns the list of allowed statement node types.
  `List<String>`
  `getAllowedStaticImports()`
  Returns the list of allowed static imports.
  `List<String>`
  `getAllowedStaticStarImports()`
  Returns the list of allowed static star imports.
  `List<Integer>`
  `getAllowedTokens()`
  Returns the list of allowed token types.
  `List<String>`
  `getConstantTypesBlackList()`
  Deprecated.
  `List<String>`
  `getConstantTypesWhiteList()`
  Deprecated.
  `List<String>`
  `getDisallowedConstantTypes()`
  Returns the list of disallowed constant or variable types.
  `List<Class<? extends Expression>>`
  `getDisallowedExpressions()`
  Returns the list of disallowed expression node types.
  `List<String>`
  `getDisallowedImports()`
  Returns the list of explicitly disallowed imports.
  `List<String>`
  `getDisallowedReceivers()`
  Returns the list of receiver types on which calls are disallowed.
  `List<String>`
  `getDisallowedStarImports()`
  Returns the list of disallowed star imports.
  `List<Class<? extends Statement>>`
  `getDisallowedStatements()`
  Returns the list of disallowed statement node types.
  `List<String>`
  `getDisallowedStaticImports()`
  Returns the list of disallowed static imports.
  `List<String>`
  `getDisallowedStaticStarImports()`
  Returns the list of disallowed static star imports.
  `List<Integer>`
  `getDisallowedTokens()`
  Returns the list of disallowed token types.
  `List<Class<? extends Expression>>`
  `getExpressionsBlacklist()`
  Deprecated.
  `List<Class<? extends Expression>>`
  `getExpressionsWhitelist()`
  Deprecated.
  `List<String>`
  `getImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getImportsWhitelist()`
  Deprecated.
  `List<String>`
  `getReceiversBlackList()`
  Deprecated.
  `List<String>`
  `getReceiversWhiteList()`
  Deprecated.
  `List<String>`
  `getStarImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStarImportsWhitelist()`
  Deprecated.
  `List<Class<? extends Statement>>`
  `getStatementsBlacklist()`
  Deprecated.
  `List<Class<? extends Statement>>`
  `getStatementsWhitelist()`
  Deprecated.
  `List<String>`
  `getStaticImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStaticImportsWhitelist()`
  Deprecated.
  `List<String>`
  `getStaticStarImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStaticStarImportsWhitelist()`
  Deprecated.
  `List<Integer>`
  `getTokensBlacklist()`
  Deprecated.
  `List<Integer>`
  `getTokensWhitelist()`
  Deprecated.
  `boolean`
  `isClosuresAllowed()`
  Indicates whether closures are allowed.
  `boolean`
  `isIndirectImportCheckEnabled()`
  Indicates whether indirect import checks are enabled.
  `boolean`
  `isMethodDefinitionAllowed()`
  Indicates whether explicit method definitions are allowed.
  `boolean`
  `isPackageAllowed()`
  Indicates whether package declarations are allowed.
  `void`
  `setAllowedConstantTypes(List<String> allowedConstantTypes)`
  Sets the list of allowed constant or variable types.
  `void`
  `setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)`
  An alternative way of setting constant types.
  `void`
  `setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)`
  Sets the list of allowed expression node types.
  `void`
  `setAllowedImports(List<String> allowedImports)`
  Sets the list of explicitly allowed imports.
  `void`
  `setAllowedReceivers(List<String> allowedReceivers)`
  Sets the list of classes which may accept method calls.
  `void`
  `setAllowedReceiversClasses(List<Class> allowedReceivers)`
  An alternative way of setting `receiver classes`.
  `void`
  `setAllowedStarImports(List<String> allowedStarImports)`
  Sets the list of allowed star imports.
  `void`
  `setAllowedStatements(List<Class<? extends Statement>> allowedStatements)`
  Sets the list of allowed statement node types.
  `void`
  `setAllowedStaticImports(List<String> allowedStaticImports)`
  Sets the list of allowed static imports.
  `void`
  `setAllowedStaticStarImports(List<String> allowedStaticStarImports)`
  Sets the list of allowed static star imports.
  `void`
  `setAllowedTokens(List<Integer> allowedTokens)`
  Sets the list of tokens which are permitted.
  `void`
  `setClosuresAllowed(boolean closuresAllowed)`
  Sets whether closures are allowed.
  `void`
  `setConstantTypesBlackList(List<String> constantTypesBlackList)`
  Sets the list of disallowed constant or variable types.
  `void`
  `setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)`
  Deprecated.
  `void`
  `setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)`
  Deprecated.
  `void`
  `setConstantTypesWhiteList(List<String> allowedConstantTypes)`
  Deprecated.
  `void`
  `setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)`
  An alternative way of setting constant types.
  `void`
  `setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)`
  Sets the list of disallowed expression node types.
  `void`
  `setDisallowedImports(List<String> disallowedImports)`
  Sets the list of explicitly disallowed imports.
  `void`
  `setDisallowedReceivers(List<String> disallowedReceivers)`
  Sets the list of classes which deny method calls.
  `void`
  `setDisallowedReceiversClasses(List<Class> disallowedReceivers)`
  An alternative way of setting `receiver classes`.
  `void`
  `setDisallowedStarImports(List<String> disallowedStarImports)`
  Sets the list of disallowed star imports.
  `void`
  `setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)`
  Sets the list of disallowed statement node types.
  `void`
  `setDisallowedStaticImports(List<String> disallowedStaticImports)`
  Sets the list of disallowed static imports.
  `void`
  `setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)`
  Sets the list of disallowed static star imports.
  `void`
  `setDisallowedTokens(List<Integer> disallowedTokens)`
  Sets the list of tokens which are not permitted.
  `void`
  `setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)`
  Deprecated.
  `void`
  `setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)`
  Deprecated.
  `void`
  `setImportsBlacklist(List<String> disallowedImports)`
  Deprecated.
  `void`
  `setImportsWhitelist(List<String> allowedImports)`
  Deprecated.
  `void`
  `setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)`
  Set this option to true to apply the import rules to types which appear in the source without an import statement, most usefully to prevent a class being instantiated by fully qualified name.
  `void`
  `setMethodDefinitionAllowed(boolean methodDefinitionAllowed)`
  Sets whether explicit method definitions are allowed.
  `void`
  `setPackageAllowed(boolean packageAllowed)`
  Sets whether package declarations are allowed.
  `void`
  `setReceiversBlackList(List<String> disallowedReceivers)`
  Deprecated.
  `void`
  `setReceiversClassesBlackList(List<Class> disallowedReceivers)`
  Deprecated.
  `void`
  `setReceiversClassesWhiteList(List<Class> allowedReceivers)`
  Deprecated.
  `void`
  `setReceiversWhiteList(List<String> allowedReceivers)`
  Deprecated.
  `void`
  `setStarImportsBlacklist(List<String> disallowedStarImports)`
  Deprecated.
  `void`
  `setStarImportsWhitelist(List<String> allowedStarImports)`
  Deprecated.
  `void`
  `setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)`
  Deprecated.
  `void`
  `setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)`
  Deprecated.
  `void`
  `setStaticImportsBlacklist(List<String> disallowedStaticImports)`
  Deprecated.
  `void`
  `setStaticImportsWhitelist(List<String> allowedStaticImports)`
  Deprecated.
  `void`
  `setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)`
  Deprecated.
  `void`
  `setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)`
  Deprecated.
  `void`
  `setTokensBlacklist(List<Integer> disallowedTokens)`
  Deprecated.
  `void`
  `setTokensWhitelist(List<Integer> allowedTokens)`
  Deprecated.
  `protected void`
  `visitConstructorsAndInitializers(ClassNode clNode, GroovyCodeVisitor visitor)`
  Applies the security checks to code which lives outside method bodies: constructors, instance and static initializer blocks, and field initializer expressions.
  `protected void`
  `visitSyntheticMethods(ClassNode clNode, GroovyCodeVisitor visitor)`
  Applies the security checks to code the author wrote which a transformation has relocated into a synthetic method.

  ### Methods inherited from class org.codehaus.groovy.control.customizers.CompilationCustomizer

  `getPhase`

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

  ### Methods inherited from interface org.codehaus.groovy.control.CompilationUnit.IPrimaryClassNodeOperation

  `doPhaseOperation, needSortedInput`

- ## Constructor Details

  - ### SecureASTCustomizer

    public SecureASTCustomizer()
    Creates a secure AST customizer that runs during canonicalization.

- ## Method Details

  - ### isMethodDefinitionAllowed

    public boolean isMethodDefinitionAllowed()
    Indicates whether explicit method definitions are allowed.
    Returns:
      `true` if method definitions are allowed

  - ### setMethodDefinitionAllowed

    public void setMethodDefinitionAllowed(boolean methodDefinitionAllowed)
    Sets whether explicit method definitions are allowed.
    Parameters:
      `methodDefinitionAllowed` - `true` to allow method definitions

  - ### isPackageAllowed

    public boolean isPackageAllowed()
    Indicates whether package declarations are allowed.
    Returns:
      `true` if package declarations are allowed

  - ### isClosuresAllowed

    public boolean isClosuresAllowed()
    Indicates whether closures are allowed.
    Returns:
      `true` if closures are allowed

  - ### setClosuresAllowed

    public void setClosuresAllowed(boolean closuresAllowed)
    Sets whether closures are allowed.
    Parameters:
      `closuresAllowed` - `true` to allow closures

  - ### setPackageAllowed

    public void setPackageAllowed(boolean packageAllowed)
    Sets whether package declarations are allowed.
    Parameters:
      `packageAllowed` - `true` to allow package declarations

  - ### getDisallowedImports

    public List<String> getDisallowedImports()
    Returns the list of explicitly disallowed imports.
    Returns:
      the disallowed imports, or `null`

  - ### getImportsBlacklist

    @Deprecated public List<String> getImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedImports()`

  - ### setDisallowedImports

    public void setDisallowedImports(List<String> disallowedImports)
    Sets the list of explicitly disallowed imports.
    Parameters:
      `disallowedImports` - the imports to reject

  - ### setImportsBlacklist

    @Deprecated public void setImportsBlacklist(List<String> disallowedImports)
    Deprecated.
    Legacy alias for `setDisallowedImports(List)`

  - ### getAllowedImports

    public List<String> getAllowedImports()
    Returns the list of explicitly allowed imports.
    Returns:
      the allowed imports, or `null`

  - ### getImportsWhitelist

    @Deprecated public List<String> getImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedImports()`

  - ### setAllowedImports

    public void setAllowedImports(List<String> allowedImports)
    Sets the list of explicitly allowed imports.
    Parameters:
      `allowedImports` - the imports to allow

  - ### setImportsWhitelist

    @Deprecated public void setImportsWhitelist(List<String> allowedImports)
    Deprecated.
    Legacy alias for `setAllowedImports(List)`

  - ### getDisallowedStarImports

    public List<String> getDisallowedStarImports()
    Returns the list of disallowed star imports.
    Returns:
      the disallowed star imports, or `null`

  - ### getStarImportsBlacklist

    @Deprecated public List<String> getStarImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStarImports()`

  - ### setDisallowedStarImports

    public void setDisallowedStarImports(List<String> disallowedStarImports)
    Sets the list of disallowed star imports.
    Parameters:
      `disallowedStarImports` - the star imports to reject

  - ### setStarImportsBlacklist

    @Deprecated public void setStarImportsBlacklist(List<String> disallowedStarImports)
    Deprecated.
    Legacy alias for `setDisallowedStarImports(List)`

  - ### getAllowedStarImports

    public List<String> getAllowedStarImports()
    Returns the list of allowed star imports.
    Returns:
      the allowed star imports, or `null`

  - ### getStarImportsWhitelist

    @Deprecated public List<String> getStarImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStarImports()`

  - ### setAllowedStarImports

    public void setAllowedStarImports(List<String> allowedStarImports)
    Sets the list of allowed star imports.
    Parameters:
      `allowedStarImports` - the star imports to allow

  - ### setStarImportsWhitelist

    @Deprecated public void setStarImportsWhitelist(List<String> allowedStarImports)
    Deprecated.
    Legacy alias for `setAllowedStarImports(List)`

  - ### getDisallowedStaticImports

    public List<String> getDisallowedStaticImports()
    Returns the list of disallowed static imports.
    Returns:
      the disallowed static imports, or `null`

  - ### getStaticImportsBlacklist

    @Deprecated public List<String> getStaticImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStaticImports()`

  - ### setDisallowedStaticImports

    public void setDisallowedStaticImports(List<String> disallowedStaticImports)
    Sets the list of disallowed static imports.
    Parameters:
      `disallowedStaticImports` - the static imports to reject

  - ### setStaticImportsBlacklist

    @Deprecated public void setStaticImportsBlacklist(List<String> disallowedStaticImports)
    Deprecated.
    Legacy alias for `setDisallowedStaticImports(List)`

  - ### getAllowedStaticImports

    public List<String> getAllowedStaticImports()
    Returns the list of allowed static imports.
    Returns:
      the allowed static imports, or `null`

  - ### getStaticImportsWhitelist

    @Deprecated public List<String> getStaticImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStaticImports()`

  - ### setAllowedStaticImports

    public void setAllowedStaticImports(List<String> allowedStaticImports)
    Sets the list of allowed static imports.
    Parameters:
      `allowedStaticImports` - the static imports to allow

  - ### setStaticImportsWhitelist

    @Deprecated public void setStaticImportsWhitelist(List<String> allowedStaticImports)
    Deprecated.
    Legacy alias for `setAllowedStaticImports(List)`

  - ### getDisallowedStaticStarImports

    public List<String> getDisallowedStaticStarImports()
    Returns the list of disallowed static star imports.
    Returns:
      the disallowed static star imports, or `null`

  - ### getStaticStarImportsBlacklist

    @Deprecated public List<String> getStaticStarImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStaticStarImports()`

  - ### setDisallowedStaticStarImports

    public void setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)
    Sets the list of disallowed static star imports.
    Parameters:
      `disallowedStaticStarImports` - the static star imports to reject

  - ### setStaticStarImportsBlacklist

    @Deprecated public void setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)
    Deprecated.
    Legacy alias for `setDisallowedStaticStarImports(List)`

  - ### getAllowedStaticStarImports

    public List<String> getAllowedStaticStarImports()
    Returns the list of allowed static star imports.
    Returns:
      the allowed static star imports, or `null`

  - ### getStaticStarImportsWhitelist

    @Deprecated public List<String> getStaticStarImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStaticStarImports()`

  - ### setAllowedStaticStarImports

    public void setAllowedStaticStarImports(List<String> allowedStaticStarImports)
    Sets the list of allowed static star imports.
    Parameters:
      `allowedStaticStarImports` - the static star imports to allow

  - ### setStaticStarImportsWhitelist

    @Deprecated public void setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)
    Deprecated.
    Legacy alias for `setAllowedStaticStarImports(List)`

  - ### getDisallowedExpressions

    public List<Class<? extends Expression>> getDisallowedExpressions()
    Returns the list of disallowed expression node types.
    Returns:
      the disallowed expression types, or `null`

  - ### getExpressionsBlacklist

    @Deprecated public List<Class<? extends Expression>> getExpressionsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedExpressions()`

  - ### setDisallowedExpressions

    public void setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)
    Sets the list of disallowed expression node types.
    Parameters:
      `disallowedExpressions` - the expression types to reject

  - ### setExpressionsBlacklist

    @Deprecated public void setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)
    Deprecated.
    Legacy alias for `setDisallowedExpressions(List)`

  - ### getAllowedExpressions

    public List<Class<? extends Expression>> getAllowedExpressions()
    Returns the list of allowed expression node types.
    Returns:
      the allowed expression types, or `null`

  - ### getExpressionsWhitelist

    @Deprecated public List<Class<? extends Expression>> getExpressionsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedExpressions()`

  - ### setAllowedExpressions

    public void setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)
    Sets the list of allowed expression node types.
    Parameters:
      `allowedExpressions` - the expression types to allow

  - ### setExpressionsWhitelist

    @Deprecated public void setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)
    Deprecated.
    Legacy alias for `setAllowedExpressions(List)`

  - ### getDisallowedStatements

    public List<Class<? extends Statement>> getDisallowedStatements()
    Returns the list of disallowed statement node types.
    Returns:
      the disallowed statement types, or `null`

  - ### getStatementsBlacklist

    @Deprecated public List<Class<? extends Statement>> getStatementsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStatements()`

  - ### setDisallowedStatements

    public void setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)
    Sets the list of disallowed statement node types.
    Parameters:
      `disallowedStatements` - the statement types to reject

  - ### setStatementsBlacklist

    @Deprecated public void setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)
    Deprecated.
    Legacy alias for `setDisallowedStatements(List)`

  - ### getAllowedStatements

    public List<Class<? extends Statement>> getAllowedStatements()
    Returns the list of allowed statement node types.
    Returns:
      the allowed statement types, or `null`

  - ### getStatementsWhitelist

    @Deprecated public List<Class<? extends Statement>> getStatementsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStatements()`

  - ### setAllowedStatements

    public void setAllowedStatements(List<Class<? extends Statement>> allowedStatements)
    Sets the list of allowed statement node types.
    Parameters:
      `allowedStatements` - the statement types to allow

  - ### setStatementsWhitelist

    @Deprecated public void setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)
    Deprecated.
    Legacy alias for `setAllowedStatements(List)`

  - ### isIndirectImportCheckEnabled

    public boolean isIndirectImportCheckEnabled()
    Indicates whether indirect import checks are enabled.
    Returns:
      `true` if indirect import checks are enabled

  - ### setIndirectImportCheckEnabled

    public void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)
    Set this option to true to apply the import rules to types which appear in the source without an import statement, most usefully to prevent a class being instantiated by fully qualified name.

    The rules are applied to the constructed type of a constructor call, to the receiver type of a method call or a static method call, to the type a method pointer or method reference is taken on, and to the constructed type of a construction by coercion — a cast whose operand is a list, map or closure literal (`(Foo) [..]`, `[..] as Foo`, `(Foo) { .. }`) and a named-argument subscript (`Foo[a: 1]`), both of which build an instance of the named type. They are not applied to every class node: class literals, property and attribute access, plain (converting) cast and declaration types, and catch types are not examined. Note also that the receiver type is the static type of that expression, which for a dynamically typed receiver is `java.lang.Object` rather than the class the call reaches at runtime.

    Parameters:
      `indirectImportCheckEnabled` - set to true to enable indirect checks

  - ### getDisallowedTokens

    public List<Integer> getDisallowedTokens()
    Returns the list of disallowed token types.
    Returns:
      the disallowed token types, or `null`

  - ### getTokensBlacklist

    @Deprecated public List<Integer> getTokensBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedTokens()`

  - ### setDisallowedTokens

    public void setDisallowedTokens(List<Integer> disallowedTokens)
    Sets the list of tokens which are not permitted.
    Parameters:
      `disallowedTokens` - the tokens. The values of the tokens must be those of `Types`

  - ### setTokensBlacklist

    @Deprecated public void setTokensBlacklist(List<Integer> disallowedTokens)
    Deprecated.
    Legacy alias for `setDisallowedTokens(List)`.

  - ### getAllowedTokens

    public List<Integer> getAllowedTokens()
    Returns the list of allowed token types.
    Returns:
      the allowed token types, or `null`

  - ### getTokensWhitelist

    @Deprecated public List<Integer> getTokensWhitelist()
    Deprecated.
    Legacy alias for `getAllowedTokens()`

  - ### setAllowedTokens

    public void setAllowedTokens(List<Integer> allowedTokens)
    Sets the list of tokens which are permitted.
    Parameters:
      `allowedTokens` - the tokens. The values of the tokens must be those of `Types`

  - ### setTokensWhitelist

    @Deprecated public void setTokensWhitelist(List<Integer> allowedTokens)
    Deprecated.
    Legacy alias for `setAllowedTokens(List)`

  - ### addStatementCheckers

    public void addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)
    Adds statement checkers consulted in addition to the allow/disallow lists.
    Parameters:
      `checkers` - the statement checkers to add

  - ### addExpressionCheckers

    public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)
    Adds expression checkers consulted in addition to the allow/disallow lists.
    Parameters:
      `checkers` - the expression checkers to add

  - ### getDisallowedConstantTypes

    public List<String> getDisallowedConstantTypes()
    Returns the list of disallowed constant or variable types.
    Returns:
      the disallowed constant types, or `null`

  - ### getConstantTypesBlackList

    @Deprecated public List<String> getConstantTypesBlackList()
    Deprecated.
    Legacy alias for `getDisallowedConstantTypes()`

  - ### setConstantTypesBlackList

    public void setConstantTypesBlackList(List<String> constantTypesBlackList)
    Sets the list of disallowed constant or variable types.
    Parameters:
      `constantTypesBlackList` - the type names to reject

  - ### getAllowedConstantTypes

    public List<String> getAllowedConstantTypes()
    Returns the list of allowed constant or variable types.
    Returns:
      the allowed constant types, or `null`

  - ### getConstantTypesWhiteList

    @Deprecated public List<String> getConstantTypesWhiteList()
    Deprecated.
    Legacy alias for `getAllowedStatements()`

  - ### setAllowedConstantTypes

    public void setAllowedConstantTypes(List<String> allowedConstantTypes)
    Sets the list of allowed constant or variable types.
    Parameters:
      `allowedConstantTypes` - the type names to allow

  - ### setConstantTypesWhiteList

    @Deprecated public void setConstantTypesWhiteList(List<String> allowedConstantTypes)
    Deprecated.
    Legacy alias for `setAllowedConstantTypes(List)`

  - ### setAllowedConstantTypesClasses

    public void setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)
    An alternative way of setting constant types.
    Parameters:
      `allowedConstantTypes` - a list of classes.

  - ### setConstantTypesClassesWhiteList

    @Deprecated public void setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)
    Deprecated.
    Legacy alias for `setAllowedConstantTypesClasses(List)`

  - ### setDisallowedConstantTypesClasses

    public void setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)
    An alternative way of setting constant types.
    Parameters:
      `disallowedConstantTypes` - a list of classes.

  - ### setConstantTypesClassesBlackList

    @Deprecated public void setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)
    Deprecated.
    Legacy alias for `setDisallowedConstantTypesClasses(List)`

  - ### getDisallowedReceivers

    public List<String> getDisallowedReceivers()
    Returns the list of receiver types on which calls are disallowed.
    Returns:
      the disallowed receiver types, or `null`

  - ### getReceiversBlackList

    @Deprecated public List<String> getReceiversBlackList()
    Deprecated.
    Legacy alias for `getDisallowedReceivers()`

  - ### setDisallowedReceivers

    public void setDisallowedReceivers(List<String> disallowedReceivers)
    Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be relatively simple to bypass any disallowed list unless the disallowed receivers list contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, the disallowed expressions list must contain both `MethodPointerExpression` and `MethodReferenceExpression` for the disallowed receivers list to function as a security check. Both are needed because the expression lists are matched by exact class: naming a class does not name its subclasses, and the `::` form of a method reference is a subclass of the `.&amp;` form.
    Parameters:
      `disallowedReceivers` - the list of refused classes, as fully qualified names

  - ### setReceiversBlackList

    @Deprecated public void setReceiversBlackList(List<String> disallowedReceivers)
    Deprecated.
    Legacy alias for `setDisallowedReceivers(List)`

  - ### setDisallowedReceiversClasses

    public void setDisallowedReceiversClasses(List<Class> disallowedReceivers)
    An alternative way of setting `receiver classes`.
    Parameters:
      `disallowedReceivers` - a list of classes.

  - ### setReceiversClassesBlackList

    @Deprecated public void setReceiversClassesBlackList(List<Class> disallowedReceivers)
    Deprecated.
    Legacy alias for `setDisallowedReceiversClasses(List)`.

  - ### getAllowedReceivers

    public List<String> getAllowedReceivers()
    Returns the list of receiver types on which calls are allowed.
    Returns:
      the allowed receiver types, or `null`

  - ### getReceiversWhiteList

    @Deprecated public List<String> getReceiversWhiteList()
    Deprecated.
    Legacy alias for `getAllowedReceivers()`

  - ### setAllowedReceivers

    public void setAllowedReceivers(List<String> allowedReceivers)
    Sets the list of classes which may accept method calls.
    Parameters:
      `allowedReceivers` - the list of accepted classes, as fully qualified names

  - ### setReceiversWhiteList

    @Deprecated public void setReceiversWhiteList(List<String> allowedReceivers)
    Deprecated.
    Legacy alias for `setAllowedReceivers(List)`

  - ### setAllowedReceiversClasses

    public void setAllowedReceiversClasses(List<Class> allowedReceivers)
    An alternative way of setting `receiver classes`.
    Parameters:
      `allowedReceivers` - a list of classes.

  - ### setReceiversClassesWhiteList

    @Deprecated public void setReceiversClassesWhiteList(List<Class> allowedReceivers)
    Deprecated.
    Legacy alias for `setAllowedReceiversClasses(List)`

  - ### call

    public void call(SourceUnit source, GeneratorContext context, ClassNode classNode) throws CompilationFailedException
    Verifies the configured security rules against the current source unit and class.
    Parameters:
      `source` - the source unit being customized
      `context` - the current generator context
      `classNode` - the class node being customized
    Throws:
      `CompilationFailedException` - if verification fails

  - ### visitSyntheticMethods

    protected void visitSyntheticMethods(ClassNode clNode, GroovyCodeVisitor visitor)
    Applies the security checks to code the author wrote which a transformation has relocated into a synthetic method. Synthetic methods are otherwise skipped, since the compiler generates a great many of them and their contents are not the author's code.

    A transformation may nonetheless move authored code there: `ConditionalInterruptibleASTTransformation` lifts the closure supplied to `@ConditionalInterrupt` into a synthetic method and calls it at every method start and every loop. Without this, the restrictions would apply to that closure everywhere except when written as an annotation member, which is not a distinction the author of the secured source could predict.

    As elsewhere, only statements carrying a source position are visited, so the generated contents of a synthetic method are left alone. `<clinit>` is handled by `visitConstructorsAndInitializers(ClassNode, GroovyCodeVisitor)` instead.

    Parameters:
      `clNode` - the class to inspect
      `visitor` - the security-checking visitor to apply

  - ### visitConstructorsAndInitializers

    protected void visitConstructorsAndInitializers(ClassNode clNode, GroovyCodeVisitor visitor)
    Applies the security checks to code which lives outside method bodies: constructors, instance and static initializer blocks, and field initializer expressions. These are not reachable from `ModuleNode.getStatementBlock()` or `ClassNode.getMethods()`, so without this they would escape the configured restrictions entirely.

    Only nodes carrying a source position are visited. The compiler and AST transformations add constructors, initializers and fields of their own — a script class always has generated constructors, for example — and those are not written by the author of the source being secured, so checking them would reject valid programs rather than restrict the author. Generated nodes normally carry no source position, which is what distinguishes them here.

    A generated member may nonetheless contain authored code, because a transformation can move it there: `@TupleConstructor(pre=...)` and `@MapConstructor(pre=...)` both relocate the supplied closure body into the constructor they generate. Such statements keep the source position they had in the original source, so the body of a member with no source position of its own is filtered statement by statement rather than skipped outright.

    Parameters:
      `clNode` - the class to inspect
      `visitor` - the security-checking visitor to apply

  - ### createGroovyCodeVisitor

    protected GroovyCodeVisitor createGroovyCodeVisitor()
    Creates the visitor that enforces statement and expression restrictions.
    Returns:
      the security-checking visitor

  - ### checkMethodDefinitionAllowed

    protected void checkMethodDefinitionAllowed(ClassNode owner)
    Ensures the supplied class does not declare methods when such definitions are forbidden.
    Parameters:
      `owner` - the class to inspect

  - ### filterMethods

    protected static List<MethodNode> filterMethods(ClassNode owner)
    Returns the non-synthetic methods declared directly by the supplied class.
    Parameters:
      `owner` - the class to inspect
    Returns:
      the directly declared, non-synthetic methods

  - ### assertStarImportIsAllowed

    protected void assertStarImportIsAllowed(String packageName)
    Verifies that a star import is allowed by the current configuration.
    Parameters:
      `packageName` - the star import to check

  - ### assertImportIsAllowed

    protected void assertImportIsAllowed(String className)
    Verifies that a regular import is allowed by the current configuration.
    Parameters:
      `className` - the imported class name

  - ### assertStaticImportIsAllowed

    protected void assertStaticImportIsAllowed(String member, String className)
    Verifies that a static import is allowed by the current configuration.
    Parameters:
      `member` - the imported member name
      `className` - the declaring class name