I just started to use the Java ScriptEngine to do little extensions to my Application then i noticed that i can import all the java classes in the script and use them without restrictions. Is there a way to specify what classes a script can use? I dont want them to do things like java.lang.System.exit(1);
Add a comment
|
3 Answers
Well, you seem to need to learn about the Java SecurityManager. That's a pretty large topic, you might want to read up on it and then post a more specific question if you have trouble making it work for you.
2 Comments
lucidd
SecuritiyManager sounds good i will look at it. Do you have any hints for me where to start on this big topic?
Daniel Darabos
SecurityManager is now deprecated in Java 17 (openjdk.org/jeps/411). What do we do?
Use the Java Security Manager. Refer this answer for an example.
Comments
I solved this by putting "importPackage = null" on the top of all scripts, it seems to work but Im not sure if this hack can be avoided.
2 Comments
webber
looks like this is the easiest way to restrict all importPackage calls
Клаус Шварц
In this case it is still possible to do something like this:
java.lang.System.exit(1);. Program will exit.