title: GroovyClassLoader parseClass security
body: <p>I'm building a Grails application that allows a user to write Groovy code, which then gets executed within my framework. This, of course, is a massive security threat, as the user could enter malicious code.</p>
  
  <p>The Groovy classes are being compiled on-the-fly with <code>GroovyClassLoader#parseClass(String)</code>.</p>
  
  <p>I would like to heavily restrict the classes and operations that the user-written Groovy class can access. There seem to be two general options, which are not mutually exclusive:</p>
  
  <p>1) To use <code>SecurityManager</code> and a policy file to restrict what code from a specific <code>codeSource</code> is allowed to do,</p>
  
  <p>2) To extend <code>GroovyClassLoader</code> and implement a package whitelist or blacklist to restrict which classes can be accessed by user code.</p>
  
  <p>Untrusted code must not be able to access GORM or the database by any means, read or write to local disk, open network sockets, write to console etc.</p>
  
  <p>I have already implemented the SecurityManager approach and it partially works, blocking the ability to at least read files, open sockets, exit the VM etc. </p>
  
  <p>However the attacker can still write to console via Groovy <code>println(String)</code> (not a significant issue), and worse: she can successfully do <code>User.list()</code> to get all users and their hashed passwords, as well as everything else in the DB! How can I prevent this?</p>
  
  <p>I'm thinking of extending GroovyClassLoader to prevent the user script from loading, for example, my domain classes in the first place. Will this be sufficient? Would you suggest something else? How can I make sure I leave no holes?</p>