By default, script approval requires explicit approval of a lot of standard groovy methods. e.g. the ones defined here:DefaultGroovyMethods. These are very basic operations for type conversions and collection handling. Nothing security relevant.
These functions should be whitelisted by ScriptApproval out of the box.