groovy - What are some techniques to avoid script approvals with a Jenkins workflow Groovy script?

Question

The following script for the Jenkins Workflow plugin:

def mapping = readFile 'a file'
mapping.eachLine {
      def line = it.tokenize('|')
      sh "${line[1]}"
}

requires script approvals:

staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods tokenize java.lang.String java.lang.String
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods eachLine java.lang.String java.lang.String

In order to have the script run successfully a build must be attempted, a manual approval must be granted, and then another build must be attempted again, and so on.

For large scripts it is a rather tedious process to keep white listing methods.

Is there a subset of groovy methods which do not require script approval and/or white listing?

Answer 1

您只需要在新运行的方法出现时批准它们。

Script Security 插件附带了一些已列入白名单的方法。您在此处列出的方法尚未使用。JENKINS-25804 默认跟踪将常规计算方法列入白名单的愿望。

请注意，如果您使用来自 SCM 脚本源的 Groovy CPS DSL，则故意没有禁用沙盒模式的选项，即使用整个脚本批准模式。这是因为管理员需要在每次提交编辑后批准整个脚本，无论多么微不足道。相比之下，使用Groovy CPS DSL源，管理员所做的每个编辑都会立即记录为已批准，而无需单独的步骤。