Script Security
The power and the flexibility of Jenkins come from the pipelines that can run Groovy code – a fully featured language independent of Jenkins. Since Jenkins pipelines allow Groovy code to be executed, a pipeline can do nearly anything that Groovy can do. The Difference from plain Groovy section in the Jenkins User Handbook lists just one difference, that some Groovy idioms are not fully supported because the pipeline code must be serialized1. Allowing us to use a real programming language, as opposed to twisting an inflexible DSL that is not designed to be a general-purpose language, provides amazing power and flexibility. With great power, of course, comes great responsibility. Take this pipeline, for example:
pipeline {
agent any
stages { stage ('Destroy') {
steps { script {
Jenkins.instance.items.each {
...