Menu ▾ ▴

#904 Add option to disable Groovy scripting altogether

_FreeMind_1.0.0
open
nobody
None
7
1 day ago
1 day ago
Daniel Polansky
No

Request: add a user option (to the GUI) to disable Groovy scripting altogether. Consider having it disabled by default.

Rationale: Groovy scripting seems to be the kind of function that opens users to security risks more than many other functions. For instance, Microsoft VBA scripting was involved in security issues. Surely many users would like to opt to have Groovy scripting disabled altogether. Currently, they seem to be able to achieve that by deleting the plugins/script directory, but that is far from ideal. In fact, there is at least one security issue relating to Groovy scripting in FreeMind: A malicious script can cause harm by escaping the security sandbox.

Second rationale: A quick way to get FreeMind working on Java 24 is to remove the scripting restrictions/sandbox (Java 24 removed the SecurityManager class). When this is done, all scripts would be able to access the file system (read files, create files, modify files, etc.), use the network, etc. And then, risk-averse users would surely want to disable scripting as long as it is not part of their workflow/way of working.

Discussion

  • Daniel Polansky

    Daniel Polansky - 1 day ago
    • Group: _FreeMind_0.8.0 --> _FreeMind_1.0.0
    • Priority: 5 --> 7
     

  • Daniel Polansky

    Daniel Polansky - 1 day ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -1,3 +1,5 @@
 Request: add a user option (to the GUI) to disable Groovy scripting altogether. Consider having it disabled by default.

 Rationale: Groovy scripting seems to be the kind of function that opens users to security risks more than many other functions. For instance, Microsoft VBA scripting was involved in security issues. Surely many users would like to opt to have Groovy scripting disabled altogether. Currently, they seem to be able to achieve that by deleting the plugins/script directory, but that is far from ideal. In fact, there is at least one security issue relating to Groovy scripting in FreeMind: [A malicious script can cause harm by escaping the security sandbox](https://sourceforge.net/p/freemind/bugs/1309/).
+
+Second rationale: A quick way to get FreeMind working on Java 24 is to remove the scripting restrictions/sandbox (Java 24 removed the SecurityManager  class). When this is done, all scripts would be able to access the file system (read files, create files, modify files, etc.), use the network, etc. And then, risk-averse users would surely want to disable scripting as long as it is not part of their workflow/way of working.
     

Log in to post a comment.