feat: bind lookup service to Groovy constant for use in scripts

[florianesser]

ING-4256

[stempler]

Do you think a specific binding is preferable over the more generic approach to add a binding for the ServiceProvider? (see ING-4256)

[florianesser]

No, if we can find a solution that avoids having to add individual bindings for every service class that we want to use in Groovy scripts, that would be better IMO. Happy to close this PR in favour of a more generic approach!

[emanuelaepure10]

Would it be alright if we squash the last two commits?

[florianesser]

Would it be alright if we squash the last two commits?

@emanuelaepure10 Yes, no need to keep my initial commit.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[florianesser]

@emanuelaepure10 I think it must be

		binding.setVariable(BINDING_SERVICE_PROVIDER, executionContext);

instead as ExecutionContext implements the ServiceProvider interface. That way, one can do e.g. the following in Groovy scripts to get an instance of LookupService:

def lookupService = _serviceProvider.getService(LookupService.class)

[stempler]

I think to be usable this has to go in line with adding exceptions to the Groovy restrictions. At least for being able to call getService on the service provider.

[emanuelaepure10]

@stempler I'm not very sure if by "adding exceptions to the Groovy restrictions." is this what you meant.

[florianesser]

@emanuelaepure10 Simon refers to the Groovy restrictions that prevent using classes and methods in Groovy scripts that are not explicitly whitelisted. Check the class RestrictiveGroovyInterceptor.

This is an example for a PR where a class was whitelisted. As Simon suggested, in this case it might make sense to investigate if only calling getService(...) should be allowed in contrast to whitelisting access to all methods of the ServiceProvider.

[stempler]

To add to that likely the check is done against the concrete implementation and not the interface (ServiceProvider) where the method is defined.
One solution for that could be creating a delegate class that implements the interface, then the delegate can be whitelisted and passed in here, regardless of what the actual implementation class of the execution context is here and what other methods it provides.

[stempler]

Instead of adding a dependency here, the allowed class should be added via the extension point in the bundle where the DelegateServiceProvider class is defined.

See here for an example.

[stempler]

LGTM, but I could imagine that for the use case with the lookup tables it could be necessary to add additional classes to be excluded from the Groovy restrictions, e.g the LookupServiceImpl.
Did you test if usage of the service is possible with active Groovy restrictions?

[emanuelaepure10]

I have test it with and without -trustGroovy

[emanuelaepure10]

Do you have any example of how to exclude a class from the Groovy restrictions?
My research bring me nowhere.
Thank you

[stempler]

Do you have any example of how to exclude a class from the Groovy restrictions?
My research bring me nowhere.

What you did for the DelegateServiceProvider here.

[emanuelaepure10]

But... the DelegateServiceProvider I add it to the Groovy restrictions, I didn't exclude it.

[stempler]

But... the DelegateServiceProvider I add it to the Groovy restrictions, I didn't exclude it.

By adding it to the allowed classes, you excluded it from the restrictions when executing Groovy. It can be accessed without lifting the restrictions.

[we-release]

🎉 This PR is included in version 5.2.0 🎉

The release is available on:

• v5.2.0
• GitHub release

Your semantic-release bot 📦🚀