[JENKINS-46327] GString map identifiers don't work in sandboxed Groovy code

The following code will fail in non-CPS-transformed sandboxed Groovy, but will pass in CPS-transformed-and-sandboxed Groovy or vanilla Groovy:

def m = [fruitA: 'apple', fruitB: 'banana']


def bKey = 'B'

assert m."fruitB" == m."fruit${bKey}"

That's obviously wrong. Not sure yet where the problem is happening but will dig.

---
Originally reported by abayer, imported from: GString map identifiers don't work in sandboxed Groovy code

• status: Open
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-09
  

Raw content of original issue

The following code will fail in non-CPS-transformed sandboxed Groovy, but will pass in CPS-transformed-and-sandboxed Groovy or vanilla Groovy:



def m = [fruitA: 'apple', fruitB: 'banana']


def bKey = 'B'

assert m."fruitB" == m."fruit${bKey}"



That's obviously wrong. Not sure yet where the problem is happening but will dig.

• environment: Script Security 1.33