Package org.codehaus.groovy.control.customizers

# Class SecureASTCustomizer

java.lang.Object
org.codehaus.groovy.control.customizers.CompilationCustomizer
org.codehaus.groovy.control.customizers.SecureASTCustomizer

All Implemented Interfaces:
  `CompilationUnit.IPrimaryClassNodeOperation`

public class SecureASTCustomizer extends CompilationCustomizer
This customizer allows securing source code by controlling what code constructs are permitted. This is typically done when using Groovy for its scripting or domain specific language (DSL) features. For example, if you only want to allow arithmetic operations in a groovy shell, you can configure this customizer to restrict package imports, method calls and so on.

Most of the security customization options found in this class work with either allowed or disallowed lists. This means that, for a single option, you can set an allowed list OR a disallowed list, but not both. You can mix allowed/disallowed strategies for different options. For example, you can have an allowed import list and a disallowed tokens list.

The recommended way of securing shells is to use allowed lists because it is guaranteed that future features of the Groovy language won't be accidentally allowed unless explicitly added to the allowed list. Using disallowed lists, you can limit the features of the language constructs supported by your shell by opting out, but new language features are then implicitly also available and this may not be desirable. The implication is that you might need to update your configuration with each new release.

If neither an allowed list nor a disallowed list is set, then everything is permitted.

Combinations of import and star import constraints are authorized as long as you use the same type of list for both. For example, you may use an import allowed list and a star import allowed list together, but you cannot use an import allowed list with a star import disallowed list. Static imports are handled separately, meaning that disallowing an import does not prevent from allowing a static import.

Eventually, if the features provided here are not sufficient, you may implement custom AST filtering handlers, either implementing the `SecureASTCustomizer.StatementChecker` interface or `SecureASTCustomizer.ExpressionChecker` interface then register your handlers thanks to the `addExpressionCheckers(ExpressionChecker...)` and `addStatementCheckers(StatementChecker...)` methods.

Here is an example of usage. We will create a groovy classloader which only supports arithmetic operations and imports the `java.lang.Math` classes by default.

     final ImportCustomizer imports = new ImportCustomizer().addStaticStars('java.lang.Math') // add static import of java.lang.Math
     final SecureASTCustomizer secure = new SecureASTCustomizer()
     secure.with {
         closuresAllowed = false
         methodDefinitionAllowed = false

         allowedImports = []
         allowedStaticImports = []
         allowedStaticStarImports = ['java.lang.Math'] // only java.lang.Math is allowed

         allowedTokens = [
                 PLUS,
                 MINUS,
                 MULTIPLY,
                 DIVIDE,
                 REMAINDER,
                 POWER,
                 PLUS_PLUS,
                 MINUS_MINUS,
                 COMPARE_EQUAL,
                 COMPARE_NOT_EQUAL,
                 COMPARE_LESS_THAN,
                 COMPARE_LESS_THAN_EQUAL,
                 COMPARE_GREATER_THAN,
                 COMPARE_GREATER_THAN_EQUAL,
         ].asImmutable()

         allowedConstantTypesClasses = [
                 Integer,
                 Float,
                 Long,
                 Double,
                 BigDecimal,
                 Integer.TYPE,
                 Long.TYPE,
                 Float.TYPE,
                 Double.TYPE
         ].asImmutable()

         allowedReceiversClasses = [
                 Math,
                 Integer,
                 Float,
                 Double,
                 Long,
                 BigDecimal
         ].asImmutable()
     }
     CompilerConfiguration config = new CompilerConfiguration()
     config.addCompilationCustomizers(imports, secure)
     GroovyClassLoader loader = new GroovyClassLoader(this.class.classLoader, config)

Note: `SecureASTCustomizer` allows you to lock down the grammar of scripts but by itself isn't intended to be the complete solution of all security issues when running scripts on the JVM. You might also want to consider setting the `groovy.grape.enable` System property to false, augmenting use of the customizer with additional techniques, and following standard security principles for JVM applications.

For more information, please read:

- Improved sandboxing of Groovy scripts
- Oracle's Secure Coding Guidelines
- 10 Java security best practices
- Thirteen rules for developing secure Java applications
- 12 Java Security Best Practices

Since:
  1.8.0

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Class
  Description
  `static interface`
  `SecureASTCustomizer.ExpressionChecker`
  This interface allows the user to provide a custom expression checker if the dis/allowed expression lists are not sufficient
  `protected class`
  `SecureASTCustomizer.SecuringCodeVisitor`
  This visitor directly implements the `GroovyCodeVisitor` interface instead of using the `CodeVisitorSupport` class to make sure that future features of the language gets managed by this visitor.
  `static interface`
  `SecureASTCustomizer.StatementChecker`
  This interface allows the user to provide a custom statement checker if the dis/allowed statement lists are not sufficient

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `SecureASTCustomizer()`

- ## Method Summary

  Modifier and Type
  Method
  Description
  `void`
  `addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)`
  `void`
  `addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)`
  `protected void`
  `assertImportIsAllowed(String className)`
  `protected void`
  `assertStarImportIsAllowed(String packageName)`
  `protected void`
  `assertStaticImportIsAllowed(String member, String className)`
  `void`
  `call(SourceUnit source, GeneratorContext context, ClassNode classNode)`
  `protected void`
  `checkMethodDefinitionAllowed(ClassNode owner)`
  `protected GroovyCodeVisitor`
  `createGroovyCodeVisitor()`
  `protected static List<MethodNode>`
  `filterMethods(ClassNode owner)`
  `List<String>`
  `getAllowedConstantTypes()`
  `List<Class<? extends Expression>>`
  `getAllowedExpressions()`
  `List<String>`
  `getAllowedImports()`
  `List<String>`
  `getAllowedReceivers()`
  `List<String>`
  `getAllowedStarImports()`
  `List<Class<? extends Statement>>`
  `getAllowedStatements()`
  `List<String>`
  `getAllowedStaticImports()`
  `List<String>`
  `getAllowedStaticStarImports()`
  `List<Integer>`
  `getAllowedTokens()`
  `List<String>`
  `getConstantTypesBlackList()`
  Deprecated.
  `List<String>`
  `getConstantTypesWhiteList()`
  Deprecated.
  `List<String>`
  `getDisallowedConstantTypes()`
  `List<Class<? extends Expression>>`
  `getDisallowedExpressions()`
  `List<String>`
  `getDisallowedImports()`
  `List<String>`
  `getDisallowedReceivers()`
  `List<String>`
  `getDisallowedStarImports()`
  `List<Class<? extends Statement>>`
  `getDisallowedStatements()`
  `List<String>`
  `getDisallowedStaticImports()`
  `List<String>`
  `getDisallowedStaticStarImports()`
  `List<Integer>`
  `getDisallowedTokens()`
  `List<Class<? extends Expression>>`
  `getExpressionsBlacklist()`
  Deprecated.
  `List<Class<? extends Expression>>`
  `getExpressionsWhitelist()`
  Deprecated.
  `List<String>`
  `getImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getImportsWhitelist()`
  Deprecated.
  `List<String>`
  `getReceiversBlackList()`
  Deprecated.
  `List<String>`
  `getReceiversWhiteList()`
  Deprecated.
  `List<String>`
  `getStarImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStarImportsWhitelist()`
  Deprecated.
  `List<Class<? extends Statement>>`
  `getStatementsBlacklist()`
  Deprecated.
  `List<Class<? extends Statement>>`
  `getStatementsWhitelist()`
  Deprecated.
  `List<String>`
  `getStaticImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStaticImportsWhitelist()`
  Deprecated.
  `List<String>`
  `getStaticStarImportsBlacklist()`
  Deprecated.
  `List<String>`
  `getStaticStarImportsWhitelist()`
  Deprecated.
  `List<Integer>`
  `getTokensBlacklist()`
  Deprecated.
  `List<Integer>`
  `getTokensWhitelist()`
  Deprecated.
  `boolean`
  `isClosuresAllowed()`
  `boolean`
  `isIndirectImportCheckEnabled()`
  `boolean`
  `isMethodDefinitionAllowed()`
  `boolean`
  `isPackageAllowed()`
  `void`
  `setAllowedConstantTypes(List<String> allowedConstantTypes)`
  `void`
  `setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)`
  An alternative way of setting constant types.
  `void`
  `setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)`
  `void`
  `setAllowedImports(List<String> allowedImports)`
  `void`
  `setAllowedReceivers(List<String> allowedReceivers)`
  Sets the list of classes which may accept method calls.
  `void`
  `setAllowedReceiversClasses(List<Class> allowedReceivers)`
  An alternative way of setting `receiver classes`.
  `void`
  `setAllowedStarImports(List<String> allowedStarImports)`
  `void`
  `setAllowedStatements(List<Class<? extends Statement>> allowedStatements)`
  `void`
  `setAllowedStaticImports(List<String> allowedStaticImports)`
  `void`
  `setAllowedStaticStarImports(List<String> allowedStaticStarImports)`
  `void`
  `setAllowedTokens(List<Integer> allowedTokens)`
  Sets the list of tokens which are permitted.
  `void`
  `setClosuresAllowed(boolean closuresAllowed)`
  `void`
  `setConstantTypesBlackList(List<String> constantTypesBlackList)`
  `void`
  `setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)`
  Deprecated.
  `void`
  `setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)`
  Deprecated.
  `void`
  `setConstantTypesWhiteList(List<String> allowedConstantTypes)`
  Deprecated.
  `void`
  `setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)`
  An alternative way of setting constant types.
  `void`
  `setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)`
  `void`
  `setDisallowedImports(List<String> disallowedImports)`
  `void`
  `setDisallowedReceivers(List<String> disallowedReceivers)`
  Sets the list of classes which deny method calls.
  `void`
  `setDisallowedReceiversClasses(List<Class> disallowedReceivers)`
  An alternative way of setting `receiver classes`.
  `void`
  `setDisallowedStarImports(List<String> disallowedStarImports)`
  `void`
  `setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)`
  `void`
  `setDisallowedStaticImports(List<String> disallowedStaticImports)`
  `void`
  `setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)`
  `void`
  `setDisallowedTokens(List<Integer> disallowedTokens)`
  Sets the list of tokens which are not permitted.
  `void`
  `setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)`
  Deprecated.
  `void`
  `setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)`
  Deprecated.
  `void`
  `setImportsBlacklist(List<String> disallowedImports)`
  Deprecated.
  `void`
  `setImportsWhitelist(List<String> allowedImports)`
  Deprecated.
  `void`
  `setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)`
  Set this option to true if you want your import rules to be checked against every class node.
  `void`
  `setMethodDefinitionAllowed(boolean methodDefinitionAllowed)`
  `void`
  `setPackageAllowed(boolean packageAllowed)`
  `void`
  `setReceiversBlackList(List<String> disallowedReceivers)`
  Deprecated.
  `void`
  `setReceiversClassesBlackList(List<Class> disallowedReceivers)`
  Deprecated.
  `void`
  `setReceiversClassesWhiteList(List<Class> allowedReceivers)`
  Deprecated.
  `void`
  `setReceiversWhiteList(List<String> allowedReceivers)`
  Deprecated.
  `void`
  `setStarImportsBlacklist(List<String> disallowedStarImports)`
  Deprecated.
  `void`
  `setStarImportsWhitelist(List<String> allowedStarImports)`
  Deprecated.
  `void`
  `setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)`
  Deprecated.
  `void`
  `setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)`
  Deprecated.
  `void`
  `setStaticImportsBlacklist(List<String> disallowedStaticImports)`
  Deprecated.
  `void`
  `setStaticImportsWhitelist(List<String> allowedStaticImports)`
  Deprecated.
  `void`
  `setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)`
  Deprecated.
  `void`
  `setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)`
  Deprecated.
  `void`
  `setTokensBlacklist(List<Integer> disallowedTokens)`
  Deprecated.
  `void`
  `setTokensWhitelist(List<Integer> allowedTokens)`
  Deprecated.

  ### Methods inherited from class org.codehaus.groovy.control.customizers.CompilationCustomizer

  `getPhase`

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

  ### Methods inherited from interface org.codehaus.groovy.control.CompilationUnit.IPrimaryClassNodeOperation

  `doPhaseOperation, needSortedInput`

- ## Constructor Details

  - ### SecureASTCustomizer

    public SecureASTCustomizer()

- ## Method Details

  - ### isMethodDefinitionAllowed

    public boolean isMethodDefinitionAllowed()

  - ### setMethodDefinitionAllowed

    public void setMethodDefinitionAllowed(boolean methodDefinitionAllowed)

  - ### isPackageAllowed

    public boolean isPackageAllowed()

  - ### isClosuresAllowed

    public boolean isClosuresAllowed()

  - ### setClosuresAllowed

    public void setClosuresAllowed(boolean closuresAllowed)

  - ### setPackageAllowed

    public void setPackageAllowed(boolean packageAllowed)

  - ### getDisallowedImports

    public List<String> getDisallowedImports()

  - ### getImportsBlacklist

    @Deprecated public List<String> getImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedImports()`

  - ### setDisallowedImports

    public void setDisallowedImports(List<String> disallowedImports)

  - ### setImportsBlacklist

    @Deprecated public void setImportsBlacklist(List<String> disallowedImports)
    Deprecated.
    Legacy alias for `setDisallowedImports(List)`

  - ### getAllowedImports

    public List<String> getAllowedImports()

  - ### getImportsWhitelist

    @Deprecated public List<String> getImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedImports()`

  - ### setAllowedImports

    public void setAllowedImports(List<String> allowedImports)

  - ### setImportsWhitelist

    @Deprecated public void setImportsWhitelist(List<String> allowedImports)
    Deprecated.
    Legacy alias for `setAllowedImports(List)`

  - ### getDisallowedStarImports

    public List<String> getDisallowedStarImports()

  - ### getStarImportsBlacklist

    @Deprecated public List<String> getStarImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStarImports()`

  - ### setDisallowedStarImports

    public void setDisallowedStarImports(List<String> disallowedStarImports)

  - ### setStarImportsBlacklist

    @Deprecated public void setStarImportsBlacklist(List<String> disallowedStarImports)
    Deprecated.
    Legacy alias for `setDisallowedStarImports(List)`

  - ### getAllowedStarImports

    public List<String> getAllowedStarImports()

  - ### getStarImportsWhitelist

    @Deprecated public List<String> getStarImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStarImports()`

  - ### setAllowedStarImports

    public void setAllowedStarImports(List<String> allowedStarImports)

  - ### setStarImportsWhitelist

    @Deprecated public void setStarImportsWhitelist(List<String> allowedStarImports)
    Deprecated.
    Legacy alias for `setAllowedStarImports(List)`

  - ### getDisallowedStaticImports

    public List<String> getDisallowedStaticImports()

  - ### getStaticImportsBlacklist

    @Deprecated public List<String> getStaticImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStaticImports()`

  - ### setDisallowedStaticImports

    public void setDisallowedStaticImports(List<String> disallowedStaticImports)

  - ### setStaticImportsBlacklist

    @Deprecated public void setStaticImportsBlacklist(List<String> disallowedStaticImports)
    Deprecated.
    Legacy alias for `setDisallowedStaticImports(List)`

  - ### getAllowedStaticImports

    public List<String> getAllowedStaticImports()

  - ### getStaticImportsWhitelist

    @Deprecated public List<String> getStaticImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStaticImports()`

  - ### setAllowedStaticImports

    public void setAllowedStaticImports(List<String> allowedStaticImports)

  - ### setStaticImportsWhitelist

    @Deprecated public void setStaticImportsWhitelist(List<String> allowedStaticImports)
    Deprecated.
    Legacy alias for `setAllowedStaticImports(List)`

  - ### getDisallowedStaticStarImports

    public List<String> getDisallowedStaticStarImports()

  - ### getStaticStarImportsBlacklist

    @Deprecated public List<String> getStaticStarImportsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStaticStarImports()`

  - ### setDisallowedStaticStarImports

    public void setDisallowedStaticStarImports(List<String> disallowedStaticStarImports)

  - ### setStaticStarImportsBlacklist

    @Deprecated public void setStaticStarImportsBlacklist(List<String> disallowedStaticStarImports)
    Deprecated.
    Legacy alias for `setDisallowedStaticStarImports(List)`

  - ### getAllowedStaticStarImports

    public List<String> getAllowedStaticStarImports()

  - ### getStaticStarImportsWhitelist

    @Deprecated public List<String> getStaticStarImportsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStaticStarImports()`

  - ### setAllowedStaticStarImports

    public void setAllowedStaticStarImports(List<String> allowedStaticStarImports)

  - ### setStaticStarImportsWhitelist

    @Deprecated public void setStaticStarImportsWhitelist(List<String> allowedStaticStarImports)
    Deprecated.
    Legacy alias for `setAllowedStaticStarImports(List)`

  - ### getDisallowedExpressions

    public List<Class<? extends Expression>> getDisallowedExpressions()

  - ### getExpressionsBlacklist

    @Deprecated public List<Class<? extends Expression>> getExpressionsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedExpressions()`

  - ### setDisallowedExpressions

    public void setDisallowedExpressions(List<Class<? extends Expression>> disallowedExpressions)

  - ### setExpressionsBlacklist

    @Deprecated public void setExpressionsBlacklist(List<Class<? extends Expression>> disallowedExpressions)
    Deprecated.
    Legacy alias for `setDisallowedExpressions(List)`

  - ### getAllowedExpressions

    public List<Class<? extends Expression>> getAllowedExpressions()

  - ### getExpressionsWhitelist

    @Deprecated public List<Class<? extends Expression>> getExpressionsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedExpressions()`

  - ### setAllowedExpressions

    public void setAllowedExpressions(List<Class<? extends Expression>> allowedExpressions)

  - ### setExpressionsWhitelist

    @Deprecated public void setExpressionsWhitelist(List<Class<? extends Expression>> allowedExpressions)
    Deprecated.
    Legacy alias for `setAllowedExpressions(List)`

  - ### getDisallowedStatements

    public List<Class<? extends Statement>> getDisallowedStatements()

  - ### getStatementsBlacklist

    @Deprecated public List<Class<? extends Statement>> getStatementsBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedStatements()`

  - ### setDisallowedStatements

    public void setDisallowedStatements(List<Class<? extends Statement>> disallowedStatements)

  - ### setStatementsBlacklist

    @Deprecated public void setStatementsBlacklist(List<Class<? extends Statement>> disallowedStatements)
    Deprecated.
    Legacy alias for `setDisallowedStatements(List)`

  - ### getAllowedStatements

    public List<Class<? extends Statement>> getAllowedStatements()

  - ### getStatementsWhitelist

    @Deprecated public List<Class<? extends Statement>> getStatementsWhitelist()
    Deprecated.
    Legacy alias for `getAllowedStatements()`

  - ### setAllowedStatements

    public void setAllowedStatements(List<Class<? extends Statement>> allowedStatements)

  - ### setStatementsWhitelist

    @Deprecated public void setStatementsWhitelist(List<Class<? extends Statement>> allowedStatements)
    Deprecated.
    Legacy alias for `setAllowedStatements(List)`

  - ### isIndirectImportCheckEnabled

    public boolean isIndirectImportCheckEnabled()

  - ### setIndirectImportCheckEnabled

    public void setIndirectImportCheckEnabled(boolean indirectImportCheckEnabled)
    Set this option to true if you want your import rules to be checked against every class node. This means that if someone uses a fully qualified class name, then it will also be checked against the import rules, preventing, for example, instantiation of classes without imports thanks to FQCN.
    Parameters:
      `indirectImportCheckEnabled` - set to true to enable indirect checks

  - ### getDisallowedTokens

    public List<Integer> getDisallowedTokens()

  - ### getTokensBlacklist

    @Deprecated public List<Integer> getTokensBlacklist()
    Deprecated.
    Legacy alias for `getDisallowedTokens()`

  - ### setDisallowedTokens

    public void setDisallowedTokens(List<Integer> disallowedTokens)
    Sets the list of tokens which are not permitted.
    Parameters:
      `disallowedTokens` - the tokens. The values of the tokens must be those of `Types`

  - ### setTokensBlacklist

    @Deprecated public void setTokensBlacklist(List<Integer> disallowedTokens)
    Deprecated.
    Legacy alias for `setDisallowedTokens(List)`.

  - ### getAllowedTokens

    public List<Integer> getAllowedTokens()

  - ### getTokensWhitelist

    @Deprecated public List<Integer> getTokensWhitelist()
    Deprecated.
    Legacy alias for `getAllowedTokens()`

  - ### setAllowedTokens

    public void setAllowedTokens(List<Integer> allowedTokens)
    Sets the list of tokens which are permitted.
    Parameters:
      `allowedTokens` - the tokens. The values of the tokens must be those of `Types`

  - ### setTokensWhitelist

    @Deprecated public void setTokensWhitelist(List<Integer> allowedTokens)
    Deprecated.
    Legacy alias for `setAllowedTokens(List)`

  - ### addStatementCheckers

    public void addStatementCheckers(SecureASTCustomizer.StatementChecker... checkers)

  - ### addExpressionCheckers

    public void addExpressionCheckers(SecureASTCustomizer.ExpressionChecker... checkers)

  - ### getDisallowedConstantTypes

    public List<String> getDisallowedConstantTypes()

  - ### getConstantTypesBlackList

    @Deprecated public List<String> getConstantTypesBlackList()
    Deprecated.
    Legacy alias for `getDisallowedConstantTypes()`

  - ### setConstantTypesBlackList

    public void setConstantTypesBlackList(List<String> constantTypesBlackList)

  - ### getAllowedConstantTypes

    public List<String> getAllowedConstantTypes()

  - ### getConstantTypesWhiteList

    @Deprecated public List<String> getConstantTypesWhiteList()
    Deprecated.
    Legacy alias for `getAllowedStatements()`

  - ### setAllowedConstantTypes

    public void setAllowedConstantTypes(List<String> allowedConstantTypes)

  - ### setConstantTypesWhiteList

    @Deprecated public void setConstantTypesWhiteList(List<String> allowedConstantTypes)
    Deprecated.
    Legacy alias for `setAllowedConstantTypes(List)`

  - ### setAllowedConstantTypesClasses

    public void setAllowedConstantTypesClasses(List<Class> allowedConstantTypes)
    An alternative way of setting constant types.
    Parameters:
      `allowedConstantTypes` - a list of classes.

  - ### setConstantTypesClassesWhiteList

    @Deprecated public void setConstantTypesClassesWhiteList(List<Class> allowedConstantTypes)
    Deprecated.
    Legacy alias for `setAllowedConstantTypesClasses(List)`

  - ### setDisallowedConstantTypesClasses

    public void setDisallowedConstantTypesClasses(List<Class> disallowedConstantTypes)
    An alternative way of setting constant types.
    Parameters:
      `disallowedConstantTypes` - a list of classes.

  - ### setConstantTypesClassesBlackList

    @Deprecated public void setConstantTypesClassesBlackList(List<Class> disallowedConstantTypes)
    Deprecated.
    Legacy alias for `setDisallowedConstantTypesClasses(List)`

  - ### getDisallowedReceivers

    public List<String> getDisallowedReceivers()

  - ### getReceiversBlackList

    @Deprecated public List<String> getReceiversBlackList()
    Deprecated.
    Legacy alias for `getDisallowedReceivers()`

  - ### setDisallowedReceivers

    public void setDisallowedReceivers(List<String> disallowedReceivers)
    Sets the list of classes which deny method calls. Please note that since Groovy is a dynamic language, and this class performs a static type check, it will be relatively simple to bypass any disallowed list unless the disallowed receivers list contains, at a minimum, Object, Script, GroovyShell, and Eval. Additionally, it is necessary to also have MethodPointerExpression in the disallowed expressions list for the disallowed receivers list to function as a security check.
    Parameters:
      `disallowedReceivers` - the list of refused classes, as fully qualified names

  - ### setReceiversBlackList

    @Deprecated public void setReceiversBlackList(List<String> disallowedReceivers)
    Deprecated.
    Legacy alias for `setDisallowedReceivers(List)`

  - ### setDisallowedReceiversClasses

    public void setDisallowedReceiversClasses(List<Class> disallowedReceivers)
    An alternative way of setting `receiver classes`.
    Parameters:
      `disallowedReceivers` - a list of classes.

  - ### setReceiversClassesBlackList

    @Deprecated public void setReceiversClassesBlackList(List<Class> disallowedReceivers)
    Deprecated.
    Legacy alias for `setDisallowedReceiversClasses(List)`.

  - ### getAllowedReceivers

    public List<String> getAllowedReceivers()

  - ### getReceiversWhiteList

    @Deprecated public List<String> getReceiversWhiteList()
    Deprecated.
    Legacy alias for `getAllowedReceivers()`

  - ### setAllowedReceivers

    public void setAllowedReceivers(List<String> allowedReceivers)
    Sets the list of classes which may accept method calls.
    Parameters:
      `allowedReceivers` - the list of accepted classes, as fully qualified names

  - ### setReceiversWhiteList

    @Deprecated public void setReceiversWhiteList(List<String> allowedReceivers)
    Deprecated.
    Legacy alias for `setAllowedReceivers(List)`

  - ### setAllowedReceiversClasses

    public void setAllowedReceiversClasses(List<Class> allowedReceivers)
    An alternative way of setting `receiver classes`.
    Parameters:
      `allowedReceivers` - a list of classes.

  - ### setReceiversClassesWhiteList

    @Deprecated public void setReceiversClassesWhiteList(List<Class> allowedReceivers)
    Deprecated.
    Legacy alias for `setAllowedReceiversClasses(List)`

  - ### call

    public void call(SourceUnit source, GeneratorContext context, ClassNode classNode) throws CompilationFailedException
    Throws:
      `CompilationFailedException`

  - ### createGroovyCodeVisitor

    protected GroovyCodeVisitor createGroovyCodeVisitor()

  - ### checkMethodDefinitionAllowed

    protected void checkMethodDefinitionAllowed(ClassNode owner)

  - ### filterMethods

    protected static List<MethodNode> filterMethods(ClassNode owner)

  - ### assertStarImportIsAllowed

    protected void assertStarImportIsAllowed(String packageName)

  - ### assertImportIsAllowed

    protected void assertImportIsAllowed(String className)

  - ### assertStaticImportIsAllowed

    protected void assertStaticImportIsAllowed(String member, String className)