allow import of Groovy code from the workspace

[daspilker]

... when script security sandbox is enabled

The idea is to add an URLClassLoader as parent for the SandboxResolvingClassLoader. The URLClassLoader is created with a single URL, the directory of the DSL script to execute or the root of the workspace for inline scripts. And the URLClassLoader will not resolve compiles classes (findClass throws ClassNotFoundException), but allows to read resources when the Item.WORKSPACE has been granted. This allows the GroovyClassLoader from GroovyShell to pick up Groovy source files. And since the compiler configuration contains the SandboxTransformer, those source files are subject to the sandbox.

[daniel-beck]

@jglick PTAL.

[jglick]

Do not follow the details of the patch. I cannot think of any vulnerability introduced by the concept: so long as you can ensure that any classes loaded are processed in source form by the sandbox transformer, it should be safe.

[markgargan]

Any update on this being merged, it would be very useful?

[bozhaojiang]

Any update on when this will be released?

[basil]

Are there any plans to allow for external libraries to be used in Job DSL scripts when security is enabled (e.g. by supporting additionalClasspath when security is enabled)?