Bitbucket Server ScriptRunner call to external Rest API in MergeCheck Permissions?

Question

I am new to groovy and bitbucket server script runner and currently do not have admin access to our server. I am attempting to write a simple MergeCheck for bitbucket server that will call to an external API and check a value in the JSON response. For now I am just attempting to create a new RESTClient object and already running into issues.

The Error...

Script87.groovy: 21: [Static type checking] - You tried to call a method which is not allowed: groovyx.net.http.RESTClient#(java.lang.Object)
 @ line 21, column 14.
   def client = new RESTClient(externalUrl)

The Code...

import retrofit2.http.Url
import groovyx.net.http.RESTClient

log.warn("Merge Check function running...")

final externalUrl = "https://catfact.ninja/fact"

def client = new RESTClient(externalUrl)

return true //Block the merge for now

This error appears every time I attempt to construct a new object. Is anyone aware if this is a permissions problem and I need to speak to an administrator? Or am I already having problems with the base concept of constructors in groovy?

Another constructor test

import java.net.URL

def testURL = new URL('https://catfact.ninja/fact')

Same error...

org.codehaus.groovy.control.MultipleCompilationErrorsException: startup failed:
Script105.groovy: 3: [Static type checking] - You tried to call a method which is not allowed: java.net.URL#(java.lang.String)
 @ line 3, column 15.
   def testURL = new URL('https://catfact.ninja/fact')
                 ^

1 error

Answer 1

this error comes as the ScriptRunner scripts in the scope of projects and repositories are running in a kind of sandbox. So, quite some functionalities of Groovy are limited by a secured context. So, the instantiation of the URL class is forbidden. Either you find some other way, which is not forbidden by the security context, or you need to get Admin access and set up the script via the Admin panel. In there the scripts are not running in that sandbox and you will be able to make requests.

To test your script you might want to try the docker image of Bitbucket (https://hub.docker.com/r/atlassian/bitbucket-server) and install ScriptRunner in a trial version in there. There you can access the Admin panel then and try your script in that environment first.