What are some techniques to avoid script approvals with a Jenkins workflow Groovy script?

Question

The following script for the Jenkins Workflow plugin:

def mapping = readFile 'a file'
mapping.eachLine {
      def line = it.tokenize('|')
      sh "${line[1]}"
}

requires script approvals:

staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods tokenize java.lang.String java.lang.String
staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods eachLine java.lang.String java.lang.String

In order to have the script run successfully a build must be attempted, a manual approval must be granted, and then another build must be attempted again, and so on.

For large scripts it is a rather tedious process to keep white listing methods.

Is there a subset of groovy methods which do not require script approval and/or white listing?

Answer 1

You just need to approve the newly run methods as they come up.

The Script Security plugin ships with some methods whitelisted already. The methods you listed here have not made it in yet. JENKINS-25804 tracks the desire to whitelist routine computational methods by default.

Note that if you are using the Groovy CPS DSL from SCM script source, there is intentionally no option to disable sandbox mode, i.e., to use whole-script approval mode. That is because an administrator would need to approve the whole script after every committed edit, no matter how trivial. By contrast, with the Groovy CPS DSL source, every edit made by an administrator gets immediately recorded as approved without a separate step.