# Parsing xml content using XmlSlurper in Jenkins groovy

**URL:** <https://community.jenkins.io/t/parsing-xml-content-using-xmlslurper-in-jenkins-groovy/5581>\
**Category:** Using Jenkins\
**Tags:** question\
**Created:** [February 2, 2023, 12:34pm UTC](https://community.jenkins.io/t/parsing-xml-content-using-xmlslurper-in-jenkins-groovy/5581 "2023-02-02T12:34:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![swsing](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@swsing](https://community.jenkins.io/u/swsing)\
**Post date:** [February 2, 2023, 12:35pm UTC](https://community.jenkins.io/t/parsing-xml-content-using-xmlslurper-in-jenkins-groovy/5581/1 "2023-02-02T12:35:00Z")

</div>

I was trying to parse xml content with XmlSlurper like described here ([The Apache Groovy programming language - Processing XML](http://groovy-lang.org/processing-xml.html))

```auto
def text = '''
    <list>
        <technology>
            <name>Groovy</name>
        </technology>
    </list>
'''

def list = new XmlSlurper().parseText(text) 

println list.technology.name.text()

```

Using a GPath expression like this _list.technology.name.text()_ works fine but requires an admin to allow “_method groovy.lang.GroovyObject getProperty java.lang.String_” which the script security plugin recommends against (“_Approving this signature may introduce a security vulnerability! You are advised to deny it._”). Since I am not the owner of the Jenkins instance, I am not sure I can convince them this is OK to approve.

Is there a way to write the code such that it does not depend on GroovyObject.getProperty being permitted? Or is there someway to configure Jenkins so that this can work? Or how to proceed ahead?

---

<div class="post-metadata">

**Author:** ![poddingue](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/poddingue/32/985_2.png) [@poddingue](https://community.jenkins.io/u/poddingue)\
**Post date:** [March 7, 2023, 2:59pm UTC](https://community.jenkins.io/t/parsing-xml-content-using-xmlslurper-in-jenkins-groovy/5581/2 "2023-03-07T14:59:00Z")

</div>

If you want to avoid using `getProperty` and still be able to parse XML content in Jenkins, you could use a different approach that doesn’t require dynamic property access.

Here’s an example:

```auto
def list = new XmlSlurper().parseText(text) 

def technology = list.'technology'
def name = technology.'name'.text()

println name

```

This code uses the `.` syntax to access XML elements and attributes, instead of using dynamic property access. This syntax is safer and doesn’t require the `getProperty` permission.

Instead of using the dot notation to access the child elements of the XML, you could use square brackets and pass the name of the child element as a string. For example:

```auto
def list = new XmlSlurper().parseText(text) 

println list['technology']['name'].text()

```

If you’re still unable to run this code due to security restrictions, you could try using the `XmlParser` instead of `XmlSlurper`. The `XmlParser` is less convenient to use than `XmlSlurper`, but it’s more secure because it doesn’t allow dynamic property access.

Here’s an example:

```auto
def parser = new XmlParser()
def list = parser.parseText(text)

println list.technology.name.text()

```

---

<div class="post-metadata">

**Author:** ![salmira](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/salmira/32/22254_2.png) [@salmira](https://community.jenkins.io/u/salmira)\
**Post date:** [July 23, 2026, 11:35am UTC](https://community.jenkins.io/t/parsing-xml-content-using-xmlslurper-in-jenkins-groovy/5581/3 "2026-07-23T11:35:59Z")

</div>

> [@poddingue](#):
>
> ```auto
> def parser = new XmlParser()
> def list = parser.parseText(text)
> 
> def technology = list.technology
> def technology = list.'technology'
> 
> ```

Both above samples fail with other error after all possible admin allowances:  
`"groovy.lang.MissingPropertyException: No such field found: field groovy.util.Node technology"`

Thus, the only valid variants which it is possible to configure via Jenkins shared library and admin access are to switch either to `list['technology']` or `list.get('technology')`