[JENKINS-70108] CastBlock must contextualize invoker to avoid issues in mixed-trust scenarios

lib/src/main/java/com/cloudbees/groovy/cps/Builder.java

@@ -588,7 +588,7 @@ public Block postfixDec(int line, LValueBlock body) {
      *      be used in all other cases, such as Java-syntax casts and implicit casts inserted by the Groovy runtime.
      */
     public Block cast(int line, Block block, Class type, boolean coerce) {
-        return new CastBlock(loc(line), block, type, false, coerce, false);
+        return new CastBlock(loc(line), tags, block, type, false, coerce, false);
     }
 
     /**

lib/src/main/java/com/cloudbees/groovy/cps/impl/CastBlock.java

@@ -4,20 +4,22 @@
 import com.cloudbees.groovy.cps.Continuation;
 import com.cloudbees.groovy.cps.Env;
 import com.cloudbees.groovy.cps.Next;
-import java.util.Collections;
+import com.cloudbees.groovy.cps.sandbox.CallSiteTag;
+import java.util.Collection;
 import java.util.List;
 import org.codehaus.groovy.runtime.InvokerInvocationException;
 import org.codehaus.groovy.runtime.ScriptBytecodeAdapter;
 
-public class CastBlock implements Block {
+public class CastBlock extends CallSiteBlockSupport {
     private final SourceLocation loc;
     private final Block valueExp;
     private final Class<?> type;
     private final boolean ignoreAutoboxing;
     private final boolean coerce;
     private final boolean strict;
 
-    public CastBlock(SourceLocation loc, Block valueExp, Class<?> type, boolean ignoreAutoboxing, boolean coerce, boolean strict) {
+    public CastBlock(SourceLocation loc, Collection<CallSiteTag> tags, Block valueExp, Class<?> type, boolean ignoreAutoboxing, boolean coerce, boolean strict) {
+        super(tags);
         this.loc = loc;
         this.valueExp = valueExp;
         this.type = type;
@@ -42,7 +44,7 @@ class ContinuationImpl extends ContinuationGroup {
 
         public Next cast(Object value) {
             try {
-                return k.receive(e.getInvoker().cast(value, type, ignoreAutoboxing, coerce, strict));
+                return k.receive(e.getInvoker().contextualize(CastBlock.this).cast(value, type, ignoreAutoboxing, coerce, strict));
             } catch (CpsCallableInvocation inv) {
                 // Implementations of asType and other methods used by the Groovy stdlib should be @NonCPS, but we
                 // just log a warning and invoke the callable anyway to maintain the existing behavior.

lib/src/test/java/com/cloudbees/groovy/cps/AbstractGroovyCpsTest.java

@@ -124,10 +124,10 @@ protected void evalCps(String script, Object expectedResult, ExceptionHandler ha
      */
     public void assertEvaluate(Object expectedReturnValue, String script) {
         evalCps(script, expectedReturnValue, e -> {
-            throw new RuntimeException("Failed to evaluate sandboxed script: " + script, e);
+            throw new RuntimeException("Failed to evaluate CPS-transformed script: " + script, e);
         });
         eval(script, expectedReturnValue, e -> {
-            throw new RuntimeException("Failed to evaluate unsandboxed script: " + script, e);
+            throw new RuntimeException("Failed to evaluate non-CPS-transformed script: " + script, e);
         });
     }
 

lib/src/test/java/com/cloudbees/groovy/cps/CpsTransformerTest.java

@@ -527,7 +527,7 @@ public void regexpOperator() throws Throwable {
     @Test
     public void arrayPassedToMethod() throws Throwable {
         assertEvaluate(4, "def m(x) {x.size()}; def a = [1, 2]; a.size() + m(a)"); // control case
-        assertEvaluate(4, "def m(x) {x.size()}; def a = [1, 2].toArray(); a.length + m(List.of(a))"); // workaround #1
+        assertEvaluate(4, "def m(x) {x.size()}; def a = [1, 2].toArray(); a.length + m(Arrays.asList(a))"); // workaround #1
         assertEvaluate(4, "@NonCPS def m(x) {x.length}; def a = [1, 2].toArray(); a.length + m(a)"); // workaround #2
         assertEvaluate(4, "def m(x) {x.length}; def a = [1, 2].toArray(); a.length + m(a)"); // formerly: groovy.lang.MissingPropertyException: No such property: length for class: java.lang.Integer
     }

lib/src/test/java/com/cloudbees/groovy/cps/sandbox/SandboxInvokerTest.java

@@ -696,4 +696,44 @@ public void sandboxInterceptsImplicitCastsArrayAssignment() throws Throwable {
                 "Script1.method3()");
     }
 
+    @Issue("JENKINS-70108")
+    @Test public void castsInTrustedCodeCalledByUntrustedCodeShouldNotBeIntercepted() throws Throwable {
+        TrustedCpsCompiler trusted = new TrustedCpsCompiler();
+        trusted.setUp();
+        getBinding().setVariable("trusted", trusted.getCsh().parse("def foo() { File f = ['secret.key'] }"));
+        assertIntercept(
+            "trusted.foo()", // Untrusted script
+            new File("secret.key"),
+            "Script1.super(Script1).setBinding(Binding)",
+            "Script1.trusted",
+            "Script1.foo()");
+    }
+
+    /*
+     * All blocks that perform boolean casts internally using ContinuationGroup.castToBoolean incorrectly intercept
+     * calls performed by the cast when the cast is in trusted code that is called by untrusted code. For boolean
+     * casts, this is not that interesting, since it only causes problems in practice if you cast a type that
+     * implements an asBoolean method that would not be allowed by the sandbox.
+     * I see two obvious ways to fix this:
+     * 1. Add a CallSiteBlock parameter to ContinuationGroup.castToBoolean, and use it to contextualize the invoker
+     *    used in that method. All Blocks that use the method would need to be updated to implement CallSiteBlock.
+     * 2. Delete ContinuationGroup.castToBoolean and replace all uses with basic Java casts to boolean. Modify
+     *    CpsTransformer to insert explicit boolean casts into the CPS-transformed program for all AST nodes whose
+     *    Blocks previously used castToBoolean.
+     */
+    @Ignore("This variant of JENKINS-70108 seems less likely to cause problems in practice and is more complex to fix")
+    @Test public void booleanCastsInTrustedCodeCalledByUntrustedCodeShouldNotBeIntercepted() throws Throwable {
+        TrustedCpsCompiler trusted = new TrustedCpsCompiler();
+        trusted.setUp();
+        getBinding().setVariable("trusted", trusted.getCsh().parse(
+                "class Test { @NonCPS def asBoolean() { false } }\n" +
+                "def foo() { if (new Test()) { 123 } else { 456 } }"));
+        assertIntercept(
+            "trusted.foo()", // Untrusted script
+            456,
+            "Script1.super(Script1).setBinding(Binding)",
+            "Script1.trusted",
+            "Script1.foo()");
+            // Currently the call to Test.asBoolean() is also intercepted, which is incorrect.
+    }
 }