{"record":{"id":"cb22fc0f62253ab5","repo":"theonedev/onedev","slug":"unauthorized-groovy-script","errorCode":null,"errorMessage":"Unauthorized groovy script: ","messagePattern":"Unauthorized groovy script: ","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/util/GroovyUtils.java","lineNumber":94,"sourceCode":"        \t\t}\n        \t}\n    \t} else {\n        \tfor (GroovyScript each: OneDev.getInstance(SettingService.class).getGroovyScripts()) {\n        \t\tif (each.getName().equals(scriptName)) {\n        \t\t\tscript = each;\n        \t\t\tbreak;\n        \t\t}\n        \t}\n    \t}\n    \tif (script != null) {\n    \t\tif (script.isAuthorized()) {\n    \t\t\ttry {\n    \t\t\t\treturn evalScript(StringUtils.join(script.getContent(), \"\\n\"), variables);\n    \t\t\t} catch (Exception e) {\n    \t\t\t\tthrow new RuntimeException(\"Error evaluating groovy script: \" + scriptName, e);\n    \t\t\t}\n    \t\t} else {\n    \t\t\tthrow new ExplicitException(\"Unauthorized groovy script: \" + scriptName);\n    \t\t}\n    \t} else {\n    \t\tthrow new ExplicitException(\"Groovy script not found: \" + scriptName);\n    \t}\n    }\n    \n    public static Object evalScript(String scriptContent, Map<String, Object> variables) {\n    \ttry {\n\t    \tClass<?> scriptClass = compile(scriptContent);\n\t\t\tScript script;\n\t\t\ttry {\n\t\t\t\tObject instance = scriptClass.getDeclaredConstructor().newInstance();\n\t\t\t\tif (!(instance instanceof Script))\n\t\t\t\t\treturn scriptClass;\n\t\t\t\telse \n\t\t\t\t\tscript = (Script) instance;\t\t\t\t\t\n\t\t\t} catch (InstantiationException | IllegalAccessException | InvocationTargetException | NoSuchMethodException e) {\n\t\t\t\tthrow new RuntimeException(e);","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/util/GroovyUtils.java#L76-L112","documentation":"GroovyUtils.evalScriptByName throws ExplicitException(\"Unauthorized groovy script: <scriptName>\") when the named script exists but its isAuthorized() flag is false. This is a deliberate security gate: unauthenticated/user-supplied scripts are not allowed to run in privileged contexts.","triggerScenarios":"Calling evalScriptByName for a script whose 'authorized' (privileged) flag is not enabled while the calling context requires an authorized script — e.g. build specs or security-critical usages referencing a user-authored script.","commonSituations":"An administrator created a script but did not mark it as authorized/privileged; someone referenced a personal or unprivileged script from a job definition; script privileges were revoked after being referenced.","solutions":["Have an administrator edit the script and enable its 'authorized' (can be used by others / privileged) flag.","Confirm the caller has permission to use the script — authorization may also depend on current user privileges.","Use a different script that is already marked as authorized.","Re-create the script as a site-level authorized script if it was user-created."],"exampleFix":"// before (script config, in UI)\nName: my-script\nAuthorized: [unchecked]  // throws ExplicitException\n// after\nName: my-script\nAuthorized: [checked]","handlingStrategy":"validation","validationCode":"Script script = scriptService.find(scriptName);\nif (script == null || !script.isAuthorized()) {\n    throw new ExplicitException(\"Script must be marked as authorized: \" + scriptName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return GroovyUtils.evalScriptByName(scriptName, variables);\n} catch (ExplicitException e) {\n    if (e.getMessage().startsWith(\"Unauthorized groovy script\")) {\n        // prompt admin to enable the authorized flag\n    }\n}","preventionTips":["Always mark scripts as authorized when they will be used from job/build definitions.","Document script privilege requirements for administrators.","Audit script authorized flags after server migrations."],"tags":["groovy","authorization","security","scripting"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}