# Unable to resolve class Number from Groovy script

**URL:** <https://discuss.elastic.co/t/unable-to-resolve-class-number-from-groovy-script/69307>\
**Category:** Elasticsearch\
**Created:** [December 16, 2016, 4:02pm UTC](https://discuss.elastic.co/t/unable-to-resolve-class-number-from-groovy-script/69307 "2016-12-16T16:02:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivank](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ivank/32/7595_2.png) [@ivank](https://discuss.elastic.co/u/ivank)\
**Post date:** [December 16, 2016, 4:02pm UTC](https://discuss.elastic.co/t/unable-to-resolve-class-number-from-groovy-script/69307/1 "2016-12-16T16:02:09Z")

</div>

Hi, guys!

I'm developing plugin for Elasticsearch 2.3 which does simple conversion of found documents for search client. This plugin uses Groovy scripts which does this conversion. I'm faced with curious problem: for example, when this script is evaluated by Elasticsearch's script service:

```java
if (doc.field instanceof Double) {
    // do some conversion under field
}

```

Here is ok, script works fine, but this:

```java
// changed Double to Number to cover all types of numbers
if (doc.field instanceof Number) {
    // do some conversion under field
}

```

gives strange exception in logs:

```auto
ScriptException[failed to compile groovy script]; nested: MultipleCompilationErrorsException[startup failed:
fd3511425ed9b373349aefab43c955d014d045e4: 1: unable to resolve class Number

```

So, I dug deeper and found that real exception is `SecurityException` wrapped into `ClassNotFoundException`, which is done in `GroovyScriptEngineService`:

```java
protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
    if (sm != null) {
        try {
            engineContext.checkPermission(new ClassPermission(name));
        } catch (SecurityException e) {
            throw new ClassNotFoundException(name, e);
        }
    }
    return super.loadClass(name, resolve);
}

```

but nothing of them has been logged.

Then I found a place in class `org.elasticsearch.script.ClassPermission` where the list of permitted classes is created:

```java

// this is the list from the old grovy sandbox impl (+ some things like String, Iterator, etc that were missing)
public static final Set<String> STANDARD_CLASSES = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(
        // jdk classes
        java.lang.Boolean.class.getName(),
        java.lang.Byte.class.getName(),
        java.lang.Character.class.getName(),
        java.lang.Double.class.getName(),
        ...

```

and there is no `java.lang.Number`, but mentioned `java.lang.Double` is added.

Questions of this topic:

1. Why I had to do non-trivial actions to know that I have to just grant access to some "forbidden" class in policy file ?
2. How do you think, is it normal to make grant to `java.lang.Number` in policy file, and other classes from `java.lang` not enumerated in `STANDARD_CLASSES` ?

---

<div class="post-metadata">

**Author:** ![mikemccand](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mikemccand](https://discuss.elastic.co/u/mikemccand)\
**Post date:** [December 16, 2016, 7:16pm UTC](https://discuss.elastic.co/t/unable-to-resolve-class-number-from-groovy-script/69307/2 "2016-12-16T19:16:49Z")

</div>

Not a direct answer to your questions, but at least some wider context:

Groovy has had security problems in the past, and so we have tried to restrict which java classes scripts can access, resulting in the very restrictive security policy you came up against.

As of ES 5.0 we've deprecated Groovy scripting in favor of the new `painless` scripting: [https://github.com/elastic/elasticsearch/pull/20244](https://github.com/elastic/elasticsearch/pull/20244)

Mike McCandless

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2017, 7:16pm UTC](https://discuss.elastic.co/t/unable-to-resolve-class-number-from-groovy-script/69307/3 "2017-01-13T19:16:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.