GROOVY-12238: SecureASTCustomizer does not check constructors, initia…

[paulk-asert]

…lizer blocks or field initializers

SecureASTCustomizer visited the script statement block and method bodies only, so code outside a method body escaped every configured restriction: disallowedReceivers, the statement and expression allow/deny lists, and any registered StatementChecker or ExpressionChecker. With disallowedReceivers = ['java.lang.System'], a call in a constructor, a static or instance initializer block, or a field initializer all compiled and ran, while the same call in the script body was correctly rejected.

The existing filters could not reach these. A static initializer ends up in , which is synthetic and so excluded by filterMethods; instance initializers live in a separate getObjectInitializerStatements() list; and field initializers hang off FieldNode, whose property backing fields are themselves synthetic.

Add visitConstructorsAndInitializers(), applying the securing visitor to declared constructors, object initializer statements, the statements inside , and field initial expressions.

Only nodes carrying a source position are visited. Constructors and initializers are not written solely by the author of the secured source: every script class has generated constructors, and AST transformations add their own. Visiting those rejects valid programs -- a first cut broke four existing tests on the script class's generated super(Binding) call, which is not marked synthetic and so cannot be excluded by any flag. Note the wrapper block is synthetic even when its statements are not, so the check is applied per statement.

Tests cover each closed gap, keep the script-body control, and pin the exemption for generated constructors so a later simplification cannot drop the source-position check unnoticed. Both Limitations sections, in the user guide and the javadoc, are updated to match.

Constructors still do not count towards methodDefinitionAllowed, and annotation members remain unvisited; both are separable changes.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 54.54545% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.9955%. Comparing base (384633b) to head (2abfcb8).
⚠️ Report is 6 commits behind head on master.

Files with missing lines	Patch %	Lines
...roovy/control/customizers/SecureASTCustomizer.java	54.5454%	6 Missing and 4 partials ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##               master      #2771        +/-   ##
==================================================
+ Coverage     69.9863%   69.9955%   +0.0093%     
- Complexity      35528      35548        +20     
==================================================
  Files            1557       1557                
  Lines          131693     131717        +24     
  Branches        24175      24183         +8     
==================================================
+ Hits            92167      92196        +29     
+ Misses          31192      31175        -17     
- Partials         8334       8346        +12     

Files with missing lines	Coverage Δ
...roovy/control/customizers/SecureASTCustomizer.java	51.7471% <54.5454%> (+0.8850%)	⬆️

... and 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[testlens-app]

✅ All tests passed ✅

🏷️ Commit: 2abfcb8
▶️ Tests: 108896 executed
⚪️ Checks: 31/31 completed

---

Learn more about TestLens at testlens.app.