GROOVY-12279: SecureASTCustomizer: apply import rules to a method pointer's target type

The indirect import check asked about a method pointer's own type. A
MethodPointerExpression fixes that to groovy.lang.Closure in its
constructor, so the check never concerned the class the pointer is taken
on, and its second argument was the whole expression text where
assertStaticImportIsAllowed expects a member name.

Both modes were wrong, in opposite directions. Measured with the check
enabled:

  disallowedImports = [java.lang.ProcessBuilder]
    new ProcessBuilder()             blocked
    ProcessBuilder.&new              allowed
    ProcessBuilder::new              allowed

  allowedImports = [java.util.ArrayList]
    ArrayList.&size                  refused

The deny list missed the pointer entirely, since nothing names Closure in
one. The allow list refused every pointer, including pointers to a class it
allowed, because Closure is not in an allow list either. So the check both
let through what it was meant to stop and stopped what it was meant to
allow.

Ask about the class the pointer is taken on, unwrapping arrays through the
same helper the method call branch uses, and pass the method name rather
than the expression text.

This changes behaviour in both directions, each toward what the flag
documents: a denied target is now refused, and a pointer to an allowed
target is now permitted where it was refused before.

An existing assertion covered java.util.LinkedList.&size under an allow
list, and passed only because Closure was absent from that list; it passes
after this change too, now for the reason it appears to be testing.

Author: paulk-asert

src/main/java/org/codehaus/groovy/control/customizers/SecureASTCustomizer.java

@@ -1508,9 +1508,14 @@ protected void assertExpressionAuthorized(final Expression expression) throws Se
                         assertImportIsAllowed(typename);
                         assertStaticImportIsAllowed(expr.getMethod(), typename);
                     } else if (expression instanceof MethodPointerExpression expr) {
-                        final String typename = expr.getType().getName();
+                        // A method pointer's own type is fixed to groovy.lang.Closure by its
+                        // constructor, so the class the import rules are about is the one the
+                        // pointer is taken on, and the member is the method it names.
+                        final String typename = getExpressionType(expr.getExpression().getType()).getName();
                         assertImportIsAllowed(typename);
-                        assertStaticImportIsAllowed(expr.getText(), typename);
+                        Expression methodName = expr.getMethodName();
+                        assertStaticImportIsAllowed(methodName instanceof ConstantExpression
+                                ? methodName.getText() : null, typename);
                     }
                 } catch (SecurityException e) {
                     throw new SecurityException("Indirect import checks prevents usage of expression", e);

src/test/groovy/org/codehaus/groovy/control/customizers/SecureASTCustomizerTest.groovy

@@ -336,6 +336,42 @@ final class SecureASTCustomizerTest {
         }
     }
 
+    // GROOVY-12279: a method pointer's own type is fixed to groovy.lang.Closure, so the
+    // indirect import check was asking about Closure rather than about the class the pointer
+    // is taken on. In deny mode that let the pointer through; in allow mode it rejected every
+    // pointer, since Closure is never in an allow list.
+    @Test
+    void testIndirectImportCheckUsesMethodPointerTarget_denied() {
+        customizer.disallowedImports = ['java.util.LinkedList']
+        customizer.indirectImportCheckEnabled = true
+        def shell = new GroovyShell(configuration)
+        assert hasSecurityException {
+            shell.evaluate('return java.util.LinkedList.&size')
+        }
+        assert hasSecurityException {
+            shell.evaluate('return java.util.LinkedList::size')
+        }
+        // The constructor form was already checked, and stays checked.
+        assert hasSecurityException {
+            shell.evaluate('return new java.util.LinkedList()')
+        }
+    }
+
+    @Test
+    void testIndirectImportCheckUsesMethodPointerTarget_allowed() {
+        customizer.allowedImports = ['java.util.ArrayList']
+        customizer.indirectImportCheckEnabled = true
+        def shell = new GroovyShell(configuration)
+        // Permitted because the target is allowed. Previously refused, because the type being
+        // asked about was Closure, which no allow list names.
+        shell.evaluate('return java.util.ArrayList.&size')
+        shell.evaluate('return java.util.ArrayList::size')
+        // A target which is not allowed is still refused.
+        assert hasSecurityException {
+            shell.evaluate('return java.util.LinkedList.&size')
+        }
+    }
+
     @Test
     void testAllowedIndirectImports() {
         customizer.allowedImports = ['java.util.ArrayList']