Groovy script throws java.lang.NoClassDefFoundError: org/codehaus/groovy/runtime/wrappers/Wrapper

[consulthys]

On my ES cluster running the latest 2.3.3 release (with groovy scripting enabled), I get the following error...

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "failed to run inline script [def rparts = ctx._source.myDate.split('T'); def rtime = rparts[1].split(':'); ctx._source.myMinute = ((rtime[0] as int) * 60) + (rtime[1] as int)] using lang [groovy]"
      }
    ],
    "type": "script_exception",
    "reason": "failed to run inline script [def rparts = ctx._source.myDate.split('T'); def rtime = rparts[1].split(':'); ctx._source.myMinute = ((rtime[0] as int) * 60) + (rtime[1] as int)] using lang [groovy]",
    "caused_by": {
      "type": "bootstrap_method_error",
      "reason": "java.lang.NoClassDefFoundError: org/codehaus/groovy/runtime/wrappers/Wrapper",
      "caused_by": {
        "type": "no_class_def_found_error",
        "reason": "org/codehaus/groovy/runtime/wrappers/Wrapper",
        "caused_by": {
          "type": "class_not_found_exception",
          "reason": "org.codehaus.groovy.runtime.wrappers.Wrapper"
        }
      }
    }
  },
  "status": 500
}

...when I execute the following update-by-query

POST my-index/_update_by_query
{
  "script": {
    "inline": "def rparts = ctx._source.myDate.split('T'); def rtime = rparts[1].split(':'); ctx._source.myMinute = ((rtime[0] as int) * 60) + (rtime[1] as int)"
  },
  "query": {
    "bool": {
      "filter": {
        "missing": {
          "field": "myMinute"
        }
      }
    }
  }
}

It is worth noting that if I add the following class permission to the grants of the /modules/lang-groovy/plugin-security.policy file and restart my cluster, the script executes fine.

permission org.elasticsearch.script.ClassPermission "org.codehaus.groovy.runtime.wrappers.Wrapper";

It is very similar to what's been reported here and to some extent this issue.

[consulthys]

I've figured out that the as int type coercion is what's causing the error.

If I change the script to use the explicit new Integer(...) constructor instead of using type coercions, then it works flawlessly.

"inline": "def rparts = ctx._source.myDate.split('T'); def rtime = rparts[1].split(':'); ctx._source.myMinute = (new Integer(rtime[0]) * 60) + new Integer(rtime[1])"

I still think the class permission should be added to the policy file of the lang-groovy module, since type coercion is a perfectly valid groovy construct.

[rmuir]

These classes are not whitelisted, because groovy "wrappers" are extremely insecure. For example they augment any List with an execute method.

[consulthys]

That's fair enough, no big deal since I have an alternative.
Thanks much for your input, Robert.

[cfuerst]

thnx alot @consulthys for sharing this!