Security

Untrusted code execution is dangerous: Groovy scripts can call any Java API (System.exit, Runtime.exec, file access). Never evaluate untrusted input with GroovyShell/Eval without strong sandboxing.

Sandboxing layers:

SecureASTCustomizer (whitelist/blacklist imports, receivers, tokens, statements: a compile-time defense, but bypassable via dynamic tricks)

@TimedInterrupt/@ThreadInterrupt (stop runaway scripts) Custom GroovyClassLoader restrictions

Run scripts in a separate process/container with OS-level limits (the strongest option)

The Jenkins Script Security plugin approach (a whitelisting interceptor: groovy-sandbox)

SQL injection: use GString/parameterized Sql methods (Module 35).

XML: disable external entities (XXE) when parsing untrusted XML (new XmlSlurper(false, false) plus setting the feature disallow-doctype-decl).

Deserialization: avoid Java serialization of untrusted data. Groovy has had gadget-chain CVEs in the past (keep Groovy updated).

Dependencies: @Grab downloads at runtime. Pin versions, use trusted repositories, and scan with OWASP Dependency-Check or Snyk.

Secrets: don't hardcode them in Jenkinsfiles or scripts. Use credential stores (Jenkins credentials, Vault).