I have some code that dynamically loads classes from several JARs in a directory. Because the code in the JARs is untrusted, I wish to protect the main application from poorly-coded or malicious dynamic classes by "sandboxing" them. One thing I'm trying to do is "timebox" the untrusted code's execution, and kill it if it's taking too long (because it's stuck in an infinite loop, for instance). I'm trying to implement this using Callable and Future, not because I want to run the tasks in parallel (I don't), but to take advantage of work done to provide a return value, capture exceptions, and cancel running tasks. However, when I run it on some test code, I'm finding that invoking Future.cancel(true) doesn't seem to cancel the task.
I've seen several questions (such as this one) on StackOverflow about why this would occur, and the answer is always the same: cancel(true) works by invoking interrupt() on the thread running the Callable, which requires that the cancelled task block on an interrupt()ible operation (such as Thread.sleep()) before the cancellation will take effect. Since I don't control the code being executed, there's no guarantee that it will ever do that, so I can't be sure that I've cancelled it.
Is there any way that I can run dynamically-loaded code, then later kill it in progress and be sure it dies, even if it never blocks on an interrupt()ible operation?
// Assume: ExecutorService pool, Callable<T> task,
// long timeout, TimeUnit timeUnit
Future<T> future = pool.submit(task);
T result;
try {
result = future.get(timeout, timeUnit);
// do something with result
} catch (TimeoutException ex) {
future.cancel(true);
// handle timeout
} catch (ExecutionException ex) {
// handle exeception thrown by task
} catch (InterruptedException ex) {
// handle InterruptedException
}
Process p = Runtime.getRuntime().exec( cmd );
. The process can really be destroyed withProcess.destroy
if necessary.