use

invokeConstructor

invokeStaticMethod

invokeMethod

MetaClassRegistry metaClassRegistry = getMetaClassRegistry();
metaClassRegistry.setMetaClassCreationHandle(new SecureMetaClassCreationHandle());

public class SecureMetaClassCreationHandle extends MetaClassRegistry.MetaClassCreationHandle {

    @Override
    protected MetaClass createNormalMetaClass(Class theClass, MetaClassRegistry registry) {

        if (GeneratedClosure.class.isAssignableFrom(theClass)) {
            return new ClosureMetaClass(registry, theClass);
        } else {
return new SecureMetaClass(registry, theClass);
        }
    }
}

public class SecureMetaClass extends MetaClassImpl {

    private static final String staticOrNullTarget = "[Static|Null]";
    
    public SecureMetaClass(Class theClass, MetaMethod[] add) {

        super(theClass, add);
    }

    public SecureMetaClass(Class theClass) {

        super(theClass);
    }

    public SecureMetaClass(MetaClassRegistry registry, Class theClass, MetaMethod[] add) {

        super(registry, theClass, add);
    }

    public SecureMetaClass(MetaClassRegistry registry, Class theClass) {

        super(registry, theClass);
    }

    @Override
    public CallSite createPojoCallSite(CallSite site, Object receiver, Object[] args) {

        CallSiteKey callSiteKey = new CallSiteKey(getReceiverName(receiver), site.getName());
        checkRestrictions(receiver, callSiteKey, args);

        return super.createPojoCallSite(site, receiver, args);
    }

    @Override
    public CallSite createStaticSite(CallSite site, Object[] args) {

        CallSiteKey callSiteKey = new CallSiteKey(staticOrNullTarget, site.getName());
        checkRestrictions(null, callSiteKey, args);

        return super.createStaticSite(site, args);
    }

    @Override
    public Object invokeConstructor(Object[] arguments) {

        MetaReceiver metaReceiver = new MetaReceiver(null, getTheClass());
        CallSiteKey callSiteKey = new CallSiteKey(staticOrNullTarget, "<$constructor$>");
        checkRestrictions(metaReceiver, callSiteKey, arguments);

        return super.invokeConstructor(arguments);
    }

    @Override
    public Object invokeStaticMethod(Object object, String methodName, Object[] arguments) {

        CallSiteKey callSiteKey = new CallSiteKey(staticOrNullTarget, methodName);
        checkRestrictions(null, callSiteKey, arguments);

        return super.invokeStaticMethod(object, methodName, arguments);
    }

    @Override
    public Object invokeMethod(Object object, String methodName, Object arguments) {

        CallSiteKey callSiteKey = new CallSiteKey(getReceiverName(object), methodName);

        if (arguments == null) {
            checkRestrictions(object, callSiteKey, MetaClassHelper.EMPTY_ARRAY);
        }
        if (arguments instanceof Tuple<?> tuple) {
            checkRestrictions(object, callSiteKey, tuple.toArray());
        }
        if (arguments instanceof Object[] object1s) {
            checkRestrictions(object, callSiteKey, object1s);
        }

        return super.invokeMethod(object, methodName, arguments);
    }

    private String getReceiverName(Object receiver) {

        if (receiver != null) {
            if (receiver instanceof GroovyObject) {
                return GroovyObject.class.cast(receiver).getMetaClass().getTheClass().getCanonicalName();
            } else {
                return receiver.getClass().getCanonicalName();
            }
        } else {
            return staticOrNullTarget;
        }
    }

    private void checkRestrictions(Object object, CallSiteKey callSiteKey, Object[] args) {

        // Check if constructor/method/static method calls are allowed based on whitelist/blacklist rules
    }

    private static class CallSiteKey {

        private String siteReceiver;
        private String siteName;

        public CallSiteKey(String siteReceiver, String siteName) {

            this.siteReceiver = siteReceiver;
            this.siteName = siteName;
        }

        @Override
        public boolean equals(Object o) {

            if (this == o)
                return true;
            if (o == null || getClass() != o.getClass())
                return false;
            CallSiteKey that = (CallSiteKey) o;
            return Objects.equals(siteName, that.siteName) &&
                    Objects.equals(siteReceiver, that.siteReceiver);
        }

        @Override
        public int hashCode() {

            return Objects.hash(siteReceiver, siteName);
        }

        @Override
        public String toString() {

            return "CallSiteKey{" +
                    "sitReceiver='" + siteReceiver + "'\''" +
                    ", siteName='" + siteName + '\'' +
                    '}';
        }
    }
}