theonedev/onedev · error · ExplicitException

Unauthorized groovy script:

Error message

Unauthorized groovy script: 

What it means

GroovyUtils.evalScriptByName throws ExplicitException("Unauthorized groovy script: <scriptName>") when the named script exists but its isAuthorized() flag is false. This is a deliberate security gate: unauthenticated/user-supplied scripts are not allowed to run in privileged contexts.

Source

Thrown at server-core/src/main/java/io/onedev/server/util/GroovyUtils.java:94

        		}
        	}
    	} else {
        	for (GroovyScript each: OneDev.getInstance(SettingService.class).getGroovyScripts()) {
        		if (each.getName().equals(scriptName)) {
        			script = each;
        			break;
        		}
        	}
    	}
    	if (script != null) {
    		if (script.isAuthorized()) {
    			try {
    				return evalScript(StringUtils.join(script.getContent(), "\n"), variables);
    			} catch (Exception e) {
    				throw new RuntimeException("Error evaluating groovy script: " + scriptName, e);
    			}
    		} else {
    			throw new ExplicitException("Unauthorized groovy script: " + scriptName);
    		}
    	} else {
    		throw new ExplicitException("Groovy script not found: " + scriptName);
    	}
    }
    
    public static Object evalScript(String scriptContent, Map<String, Object> variables) {
    	try {
	    	Class<?> scriptClass = compile(scriptContent);
			Script script;
			try {
				Object instance = scriptClass.getDeclaredConstructor().newInstance();
				if (!(instance instanceof Script))
					return scriptClass;
				else 
					script = (Script) instance;					
			} catch (InstantiationException | IllegalAccessException | InvocationTargetException | NoSuchMethodException e) {
				throw new RuntimeException(e);

View on GitHub (pinned to d44925c47c)

Solutions

1. Have an administrator edit the script and enable its 'authorized' (can be used by others / privileged) flag.
2. Confirm the caller has permission to use the script — authorization may also depend on current user privileges.
3. Use a different script that is already marked as authorized.
4. Re-create the script as a site-level authorized script if it was user-created.

Example fix

// before (script config, in UI)
Name: my-script
Authorized: [unchecked]  // throws ExplicitException
// after
Name: my-script
Authorized: [checked]

Script script = scriptService.find(scriptName);
if (script == null || !script.isAuthorized()) {
    throw new ExplicitException("Script must be marked as authorized: " + scriptName);
}

try {
    return GroovyUtils.evalScriptByName(scriptName, variables);
} catch (ExplicitException e) {
    if (e.getMessage().startsWith("Unauthorized groovy script")) {
        // prompt admin to enable the authorized flag
    }
}

When it happens

Trigger: Calling evalScriptByName for a script whose 'authorized' (privileged) flag is not enabled while the calling context requires an authorized script — e.g. build specs or security-critical usages referencing a user-authored script.

Common situations: An administrator created a script but did not mark it as authorized/privileged; someone referenced a personal or unprivileged script from a job definition; script privileges were revoked after being referenced.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied
• Error evaluating groovy script:
• Groovy script not found:
• Error evaluating groovy script:
• Permission denied

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/cb22fc0f62253ab5. Report an issue: GitHub.