From 9f6c162fc36f9fcaedeb0990a043869a20e0ccc8 Mon Sep 17 00:00:00 2001 From: Bas Leijdekkers Date: Mon, 31 Aug 2026 17:48:02 +0200 Subject: [PATCH] IJPL-253651 [ssr] disable all script constraints for untrusted projects (cherry picked from commit bfc7e228412484b7a7c2d97a6060eab483597676) IJ-CR-221143 GitOrigin-RevId: 389c925c3d03d680a82daa719dd80256e2c8d4ee --- .../resources/messages/SSRBundle.properties | 3 ++- .../impl/matcher/predicates/ScriptSupport.java | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/platform/structuralsearch/resources/messages/SSRBundle.properties b/platform/structuralsearch/resources/messages/SSRBundle.properties index 516a54cc0f52..84fe76f90f04 100644 --- a/platform/structuralsearch/resources/messages/SSRBundle.properties +++ b/platform/structuralsearch/resources/messages/SSRBundle.properties @@ -274,7 +274,8 @@ error.bad.character.literal=Bad character literal error.bad.literal=Bad literal error.pattern.recursively.references.itself=Template recursively references itself error.configuration.0.not.found=Template ''{0}'' not found -error.script.constraint.for.0.has.problem.1=Script constraint for {0} has problem {1} +error.script.constraint.for.0.has.problem.1=The script constraint for the variable {0} has a problem: {1} +error.scripts.untrusted=Scripts will not be executed because the project is not trusted error.groovy.script.engine.not.available=Groovy script engine is not available error.in.groovy.parser=Error in Groovy parser diff --git a/platform/structuralsearch/source/com/intellij/structuralsearch/impl/matcher/predicates/ScriptSupport.java b/platform/structuralsearch/source/com/intellij/structuralsearch/impl/matcher/predicates/ScriptSupport.java index cb9d027c4dd4..1e3d427f9168 100644 --- a/platform/structuralsearch/source/com/intellij/structuralsearch/impl/matcher/predicates/ScriptSupport.java +++ b/platform/structuralsearch/source/com/intellij/structuralsearch/impl/matcher/predicates/ScriptSupport.java @@ -1,6 +1,7 @@ -// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license. +// Copyright 2000-2026 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license. package com.intellij.structuralsearch.impl.matcher.predicates; +import com.intellij.ide.trustedProjects.TrustedProjects; import com.intellij.openapi.diagnostic.Logger; import com.intellij.openapi.progress.ProcessCanceledException; import com.intellij.openapi.project.Project; @@ -105,6 +106,9 @@ public final class ScriptSupport { @NotNull String scriptText, @NotNull MatchOptions matchOptions ) throws MalformedPatternException { + if (!TrustedProjects.isProjectTrusted(project)) { + throw new MalformedPatternException(SSRBundle.message("error.scripts.untrusted")); + } final List engines = StructuralSearchScriptEngine.EP_NAME.getExtensionList(); if (engines.isEmpty()) { throw new MalformedPatternException(SSRBundle.message("error.groovy.script.engine.not.available"));