Groovy Sandbox and In process Script Approval

​

Default Sandbox Execution in Pipelines

pipeline {
  agent any
  stages {
    stage('Topic-1') {
      steps {
        echo 'Groovy Sandbox'
      }
    }
    stage('Topic-2') {
      steps {
        echo 'In-process Script Approval'
      }
    }
  }
}

​

How the Groovy Sandbox Works

• Jenkins checks every method call and field access against an approved allow list.
• Unapproved calls halt the script with an exception.
• Signatures awaiting approval appear under Manage Jenkins ▶ In-process Script Approval.

​

Demonstration: Unapproved Static Method

pipeline {
  agent any
  stages {
    stage('Get Hudson Instance') {
      steps {
        script {
          def hudson = hudson.model.Hudson.getInstance()
          println "Hudson Instance: ${hudson}"
        }
      }
    }
  }
}

Started by user siddharth
org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedUsageException: script not yet approved for use
    at org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.using(ScriptApproval.java:695)
    …
Finished: FAILURE

​

In-Process Script Approval UI

​

Disabling the Sandbox in Pipeline Configuration

• Unchecking Use Groovy Sandbox means only administrators can run the pipeline without further approvals.
• Non-admins see a prompt indicating that a Jenkins administrator must authorize the script.
• Administrators can approve scripts directly from the job’s configuration page.

​

Best Practices for Groovy Sandbox

1. Prefer Scripted Pipelines when advanced Groovy features are required.
2. Keep the sandbox enabled to minimize security risks.
3. Approve only read-only methods (e.g., getters). Avoid allowlisting any operations that change persisted state (e.g., execute, setters).

​

References

• Jenkins Pipeline Syntax
• Script Security Plugin
• Managing Jenkins: Script Approval