Scripting - Revision history

Dan Polansky: my mistake: the startup script is in a Java system property, not in a user property

2026-09-10T09:22:59Z

my mistake: the startup script is in a Java system property, not in a user property

Dan Polansky: +some links to user properties doc; change the statement that this page is less informative than the mind map doc

2026-09-10T07:03:47Z

+some links to user properties doc; change the statement that this page is less informative than the mind map doc

← Older revision		Revision as of 07:03, 10 September 2026
Line 1:		Line 1:
	Since [[Release 0.9.0]], FreeMind has a scripting facility using Groovy programming language, an imperative language syntactically resembling Java but with some syntactic sugar added such as optional declaration of types. The best way to get started is perhaps by reading [[Scripting/Mind map documentation]], the wiki version of the mind map documentation originally written by Christian Foltin. What follows here is ~~less informative~~ and ~~consolidated than~~ the mind map documentation. Another source is the dedicated page [[User-contributed example scripts]] for scripts supplied by FreeMind users.		Since [[Release 0.9.0]], FreeMind has a scripting facility using Groovy programming language, an imperative language syntactically resembling Java but with some syntactic sugar added such as optional declaration of types. The best way to get started is perhaps by reading [[Scripting/Mind map documentation]], the wiki version of the mind map documentation originally written by Christian Foltin. What follows here is in part duplicate and in part complementary to the mind map documentation. Another source is the dedicated page [[User-contributed example scripts]] for scripts supplied by FreeMind users.

	==Security vulnerabilities==		==Security vulnerabilities==
Line 11:		Line 11:
	* In a physical style/pattern.		* In a physical style/pattern.
	* In a file bound to a menu item.		* In a file bound to a menu item.
	* In a file set up in (or passed to) the user property startup_groovy_script and run on the FreeMind startup.		* In a file set up in (or passed to) the [[User.properties\|user property]] startup_groovy_script and run on the FreeMind startup.

	To add a new script to a node:		To add a new script to a node:
Line 182:		Line 182:
	* In a [[physical style]] (pattern), in patterns.xml file.		* In a [[physical style]] (pattern), in patterns.xml file.
	* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]). The file in which the binding happens is plugins\ScriptingEngine.xml in FreeMind installation directory (not in FreeMind home directory).		* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]). The file in which the binding happens is plugins\ScriptingEngine.xml in FreeMind installation directory (not in FreeMind home directory).
	* In a script file that is set in the startup_groovy_script user property, to be run on the startup (see also history.txt).		* In a script file that is set in the startup_groovy_script [[User.properties\|user property]], to be run on the startup (see also history.txt).

	When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).		When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).
Line 208:		Line 208:
	* In FreeMind 0.9.0, there is no way to run a Groovy script when FreeMind starts. In FreeMind 1.0.0 (and 1.0.1), FreeMind reads the "startup_groovy_script" [[User.properties\|property]] to find what script to run, if any. An example given in history.txt is by using the -D switch of java runtime: "java -Dstartup_groovy_script=accessories/ExportToPdf.groovy -jar lib/freemind.jar". Keyword: "start-up".		* In FreeMind 0.9.0, there is no way to run a Groovy script when FreeMind starts. In FreeMind 1.0.0 (and 1.0.1), FreeMind reads the "startup_groovy_script" [[User.properties\|property]] to find what script to run, if any. An example given in history.txt is by using the -D switch of java runtime: "java -Dstartup_groovy_script=accessories/ExportToPdf.groovy -jar lib/freemind.jar". Keyword: "start-up".
	* The built-in script editor is very simple/spartan: for instance, there is no syntax highlighting and no API exploration, let alone debugging like in Microsoft Office.		* The built-in script editor is very simple/spartan: for instance, there is no syntax highlighting and no API exploration, let alone debugging like in Microsoft Office.
	* There is no user interface option, not even a property in user properties, to disable scripting altogether, merely to restrict access the scripts have to file system, etc.		* There is no user interface option, not even a property in [[User.properties\|user properties]], to disable scripting altogether, merely to restrict access the scripts have to file system, etc.

	==Freeplane==		==Freeplane==
Line 219:		Line 219:
	==Changes in FreeMind 1.0.0==		==Changes in FreeMind 1.0.0==
	The following feature was added (see also [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt history.txt]):		The following feature was added (see also [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt history.txt]):
	* User property startup_groovy_script was added to indicate which script, if any, is to be run when FreeMind starts (upon startup). (For implementation, see e.g. ScriptingRegistration.java class and possibly others.)		* [[User.properties\|User property]] startup_groovy_script was added to indicate which script, if any, is to be run when FreeMind starts (upon startup). (For implementation, see e.g. ScriptingRegistration.java class and possibly others.)

	==Disabling scripting altogether==		==Disabling scripting altogether==

Dan Polansky: /* Security vulnerabilities */

2026-08-30T07:49:53Z

Security vulnerabilities

← Older revision		Revision as of 07:49, 30 August 2026
Line 3:		Line 3:
	==Security vulnerabilities==		==Security vulnerabilities==
	A bug report: [https://sourceforge.net/p/freemind/bugs/1309/ A malicious script can cause harm by escaping the security sandbox].		A bug report: [https://sourceforge.net/p/freemind/bugs/1309/ A malicious script can cause harm by escaping the security sandbox].
	: Remedy for the end user: ~~Do not open mind maps from untrustworthy/untrusted sources at all. And to be safe, do not set~~ the ~~FreeMind user property "startup_groovy_script". I, Dan Polansky, have performed an initial analysis of the issue and have not yet finished a more comprehensive analysis of this issue (23 Aug 2026)~~.		: Remedy for the end user: see the bug report.

	==Using==		==Using==

Dan Polansky: /* Implementation */

2026-08-28T12:19:10Z

Implementation

← Older revision		Revision as of 12:19, 28 August 2026
Line 181:		Line 181:
	* In a mind map in a node attribute (in the "attribute" XML element).		* In a mind map in a node attribute (in the "attribute" XML element).
	* In a [[physical style]] (pattern), in patterns.xml file.		* In a [[physical style]] (pattern), in patterns.xml file.
	* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]).		* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]). The file in which the binding happens is plugins\ScriptingEngine.xml in FreeMind installation directory (not in FreeMind home directory).
	* In a script file that is set in the startup_groovy_script user property, to be run on the startup (see also history.txt).		* In a script file that is set in the startup_groovy_script user property, to be run on the startup (see also history.txt).

Dan Polansky: /* Implementation */ drop "Reservation/limitation: the above was put together by Daniel Polansky and not reviewed by Christian Foltin": checked with Christian via email

2026-08-28T09:26:46Z

Implementation: drop "Reservation/limitation: the above was put together by Daniel Polansky and not reviewed by Christian Foltin": checked with Christian via email

← Older revision		Revision as of 09:26, 28 August 2026
Line 183:		Line 183:
	* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]).		* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]).
	* In a script file that is set in the startup_groovy_script user property, to be run on the startup (see also history.txt).		* In a script file that is set in the startup_groovy_script user property, to be run on the startup (see also history.txt).
	~~Reservation/limitation: the above was put together by Daniel Polansky and not reviewed by Christian Foltin.~~

	When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).		When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).

Dan Polansky: /* Using */ prevent the impression that the name has to end with a number

2026-08-27T11:31:11Z

Using: prevent the impression that the name has to end with a number

← Older revision		Revision as of 11:31, 27 August 2026
Line 6:		Line 6:

	==Using==		==Using==
	When stored in a mind map, each script is stored in a named attribute of a node, named for example as "script1" or "~~script2~~". One node can have multiple scripts attached.		When stored in a mind map, each script is stored in a named attribute of a node, named for example as "script1", "script2" or "scriptA". One node can have multiple scripts attached.

	Moreover, a script can be stored outside of a mind map in the following locations:		Moreover, a script can be stored outside of a mind map in the following locations:

Dan Polansky: /* Implementation */ remove "probably" and add links to partial substantiation

2026-08-27T11:29:58Z

Implementation: remove "probably" and add links to partial substantiation

← Older revision		Revision as of 11:29, 27 August 2026
Line 187:		Line 187:
	When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).		When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).

	The script attributes are ~~probably~~ distinguished from non-script attributes by their starting with "script".		The script attributes are distinguished from non-script attributes by their starting with "script" (see [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/plugins/script/ScriptEditor.java ScriptEditor.java] and the constant SCRIPT_PREFIX in [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/plugins/script/ScriptingEngine.java ScriptingEngine.java]).

	An example of storage in XML:		An example of storage in XML:

Dan Polansky: /* Security */

2026-08-25T16:14:08Z

Security

← Older revision		Revision as of 16:14, 25 August 2026
Line 166:		Line 166:

	Further notes, including those on implementation:		Further notes, including those on implementation:
	* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE).		* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE). The deprecation took place in Java 17 from 14 Sep 2021[https://www.oracle.com/news/announcement/oracle-releases-java-17-2021-09-14/]; the removal/disablement took place in Java 24 from 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/].
	* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding a switch as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk]:<p><code>-Djava.security.manager=allow</code><p>The security manager was removed/disabled in Java 24[https://openjdk.org/jeps/486], released on 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/]; FreeMind cannot run on this version or later versions, until someone implements a removal of the above restriction functionality or until someone implements it in a different way.		* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding a switch as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk]:<p><code>-Djava.security.manager=allow</code><p>The security manager was removed/disabled in Java 24[https://openjdk.org/jeps/486], released on 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/]; FreeMind cannot run on this version or later versions, until someone implements a removal of the above restriction functionality or until someone implements it in a different way.

Dan Polansky: /* Security */

2026-08-25T16:10:26Z

Security

← Older revision		Revision as of 16:10, 25 August 2026
Line 167:		Line 167:
	Further notes, including those on implementation:		Further notes, including those on implementation:
	* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE).		* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE).
	* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding ~~-Djava.security.manager=allow~~ as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk]. The security manager was removed/disabled in Java 24[https://openjdk.org/jeps/486], released on 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/]; FreeMind cannot run on this version or later versions, until someone implements a removal of the above restriction functionality or until someone implements it in a different way.		* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding a switch as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk]:<p><code>-Djava.security.manager=allow</code><p>The security manager was removed/disabled in Java 24[https://openjdk.org/jeps/486], released on 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/]; FreeMind cannot run on this version or later versions, until someone implements a removal of the above restriction functionality or until someone implements it in a different way.

	==Groovy==		==Groovy==

Dan Polansky: /* Security */

2026-08-25T16:04:07Z

Security

← Older revision		Revision as of 16:04, 25 August 2026
Line 167:		Line 167:
	Further notes, including those on implementation:		Further notes, including those on implementation:
	* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE).		* The above restrictions (on file operations, on network operations and on execution of other applications) were implemented using Java security sandbox[https://docs.oracle.com/en/java/javase/21/security/java-se-platform-security-architecture.html], in dependence on Java's SecurityManager class. That class and the associated functionality was deprecated[https://openjdk.org/jeps/411] and then removed/permanently disabled[https://openjdk.org/jeps/486][https://docs.oracle.com/en/java/javase/24/security/security-manager-is-permanently-disabled.html] from Java Runtime Environment (JRE).
	* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding -Djava.security.manager=allow as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk].		* FreeMind 0.9.0 and later (with scripting) can still be run using the JRE versions that have only deprecated but not removed the functionality, e.g. by modifying the freemind.bat file by adding -Djava.security.manager=allow as the first parameter to the java invocation[https://superuser.com/questions/1603105/freemind-on-windows-exe-wrapper-not-recognizing-openjdk]. The security manager was removed/disabled in Java 24[https://openjdk.org/jeps/486], released on 18 Mar 2025[https://www.oracle.com/news/announcement/oracle-releases-java-24-2025-03-18/]; FreeMind cannot run on this version or later versions, until someone implements a removal of the above restriction functionality or until someone implements it in a different way.

	==Groovy==		==Groovy==

← Older revision		Revision as of 09:22, 10 September 2026
Line 11:		Line 11:
	* In a physical style/pattern.		* In a physical style/pattern.
	* In a file bound to a menu item.		* In a file bound to a menu item.
	* In a file ~~set up in (or~~ passed to) the ~~[[User.properties\|user~~ property]] startup_groovy_script and run on the FreeMind startup.		* In a file passed to FreeMind via the Java system property startup_groovy_script (e.g. via switch -D upon Java invocation) and run on the FreeMind startup.[https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt][https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/plugins/script/ScriptingRegistration.java].

	To add a new script to a node:		To add a new script to a node:
Line 182:		Line 182:
	* In a [[physical style]] (pattern), in patterns.xml file.		* In a [[physical style]] (pattern), in patterns.xml file.
	* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]). The file in which the binding happens is plugins\ScriptingEngine.xml in FreeMind installation directory (not in FreeMind home directory).		* In a script file that is bound to a menu item (see also [[Scripting/Mind map documentation]]). The file in which the binding happens is plugins\ScriptingEngine.xml in FreeMind installation directory (not in FreeMind home directory).
	* In a script file that is set in the startup_groovy_script ~~[[User.properties\|user~~ property]], to be run on the startup (see also history.txt).		* In a script file that is set in the startup_groovy_script Java system property, to be run on the startup (see also [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt history.txt]).

	When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).		When stored in a mind map, scripts are stored in attributes whose names starts with "script", meaning in the attribute of the attribute function, not in the attribute of XML. Thus, the script attribute can be called "script1", "script_A", or "script_sum_calculation". Attributes created via Actions > New Script menu in the script editor are of the form "script''N''", where N is a positive integer (1, 2, ...).
Line 206:		Line 206:
	* No way to delete a script in the script editor. (But you, the user, can delete the corresponding user attribute.)		* No way to delete a script in the script editor. (But you, the user, can delete the corresponding user attribute.)
	* No way to run a script upon mind map opening or mind map closing ("hooks"). However, from a security standpoint, this is a bonus.		* No way to run a script upon mind map opening or mind map closing ("hooks"). However, from a security standpoint, this is a bonus.
	* In FreeMind 0.9.0, there is no way to run a Groovy script when FreeMind starts. In FreeMind 1.0.0 (and 1.0.1), FreeMind reads the "startup_groovy_script" ~~[[User.properties\|~~property]] to find what script to run, if any. An example given in history.txt is by using the -D switch of java runtime: "java -Dstartup_groovy_script=accessories/ExportToPdf.groovy -jar lib/freemind.jar". Keyword: "start-up".		* In FreeMind 0.9.0, there is no way to run a Groovy script when FreeMind starts. In FreeMind 1.0.0 (and 1.0.1), FreeMind reads the "startup_groovy_script" Java system property to find what script to run, if any[https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt]. An example given in history.txt is by using the -D switch of java runtime: "java -Dstartup_groovy_script=accessories/ExportToPdf.groovy -jar lib/freemind.jar". Keyword: "start-up".
	* The built-in script editor is very simple/spartan: for instance, there is no syntax highlighting and no API exploration, let alone debugging like in Microsoft Office.		* The built-in script editor is very simple/spartan: for instance, there is no syntax highlighting and no API exploration, let alone debugging like in Microsoft Office.
	* There is no user interface option, not even a property in [[User.properties\|user properties]], to disable scripting altogether, merely to restrict access the scripts have to file system, etc.		* There is no user interface option, not even a property in [[User.properties\|user properties]], to disable scripting altogether, merely to restrict access the scripts have to file system, etc.
Line 219:		Line 219:
	==Changes in FreeMind 1.0.0==		==Changes in FreeMind 1.0.0==
	The following feature was added (see also [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt history.txt]):		The following feature was added (see also [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/history.txt history.txt]):
	* ~~[[User.properties\|User~~ property]] startup_groovy_script was added to ~~indicate~~ which script, if any, is to be run when FreeMind starts (upon startup). (For implementation, see e.g. ScriptingRegistration.java class and possibly others.)		* Querying the Java system property startup_groovy_script was added to find which script, if any, is to be run when FreeMind starts (upon startup). (For implementation, see e.g. [https://sourceforge.net/p/freemind/code/ci/master/tree/freemind/plugins/script/ScriptingRegistration.java ScriptingRegistration.java] class with its call 'System.getProperty("startup_groovy_script")' and possibly others.) The Java system property can be passed to FreeMind using the -D switch.

	==Disabling scripting altogether==		==Disabling scripting altogether==