1

I have some code that dynamically loads classes from several JARs in a directory. Because the code in the JARs is untrusted, I wish to protect the main application from poorly-coded or malicious dynamic classes by "sandboxing" them. One thing I'm trying to do is "timebox" the untrusted code's execution, and kill it if it's taking too long (because it's stuck in an infinite loop, for instance). I'm trying to implement this using Callable and Future, not because I want to run the tasks in parallel (I don't), but to take advantage of work done to provide a return value, capture exceptions, and cancel running tasks. However, when I run it on some test code, I'm finding that invoking Future.cancel(true) doesn't seem to cancel the task.

I've seen several questions (such as this one) on StackOverflow about why this would occur, and the answer is always the same: cancel(true) works by invoking interrupt() on the thread running the Callable, which requires that the cancelled task block on an interrupt()ible operation (such as Thread.sleep()) before the cancellation will take effect. Since I don't control the code being executed, there's no guarantee that it will ever do that, so I can't be sure that I've cancelled it.

Is there any way that I can run dynamically-loaded code, then later kill it in progress and be sure it dies, even if it never blocks on an interrupt()ible operation?

// Assume: ExecutorService pool, Callable<T> task,
//  long timeout, TimeUnit timeUnit
Future<T> future = pool.submit(task);
T result;

try {
    result = future.get(timeout, timeUnit);
    // do something with result
} catch (TimeoutException ex) {
    future.cancel(true);
    // handle timeout
} catch (ExecutionException ex) {
    // handle exeception thrown by task
} catch (InterruptedException ex) {
    // handle InterruptedException
}
3
  • 2
    Next to Thread.stop and Thread.destroy, you can for ultimate sandboxing, spawn a whole JVM in a subprocess with Process p = Runtime.getRuntime().exec( cmd );. The process can really be destroyed with Process.destroy if necessary.
    – ewernli
    Jul 24, 2012 at 19:59
  • Spinning off a new JVM is certainly one way to address it, although it does raise the question of communication between the spawned JVM and the original one. I could probably solve that by having the spawned JVM redirect System.out and System.err to intercept anything the untrusted code might spit out there, then use the original System.out and System.err to communicate results to the parent JVM. I'll have to try that out and see if I can get it to work. If so, and if you want to post this as an actual answer, I'll accept it. Jul 26, 2012 at 16:51
  • Done and expanded a bit the answer.
    – ewernli
    Jul 27, 2012 at 8:26

2 Answers 2

3

The cancellation, or rather thread interruption, mechanism is fundamentally cooperative and there is nothing you can do to interrupt a rogue task. Your only option, very dangerous for many reasons, is to Thread.stop() them.

4
  • or fork a JVM and kill it if it takes too long?
    – Toby
    Jul 25, 2012 at 8:41
  • @Toby That is indeed the robust approach, however it is not clear whether it is an avenue open to OP. Jul 25, 2012 at 8:47
  • That is a possibility I intend to investigate. (See my response to ewernli's comment on the question.) Jul 26, 2012 at 16:52
  • Robert, since you didn't include an explicit @ewernli, he probably won't be notified of your comment. Jul 26, 2012 at 19:31
1

Next to Thread.stop and Thread.destroy, you can for ultimate sandboxing, spawn a whole JVM in a subprocess with Process p = Runtime.getRuntime().exec( cmd );. The process can really be destroyed with Process.destroy if necessary.

To ease the process creation, use ProcessBuilder. Also, look a available tutorial (this one is in french) to execute process, wait until completion (with waitFor), and manage streams.

I've seen it working in a product where we needed to convert ps document to pdf. We were dumping the ps file, executing ps2pdf, then reading the output file.

Pro/cons of Process:

  • (+) real sandboxing into a separate process
  • (-) communication between JVM harder to deal with
  • (-) complicates the deployment of the app (path of the JVM, options, current directory, etc.)

Note that Thread.stop and Thread.destroy (I'm not sure it's been actually implemented) are discouraged because they are unsafe with respect to locks acquisition and release. Make sure you read Why Are Thread.stop, Thread.suspend, Thread.resume and Runtime.runFinalizersOnExit Deprecated? If the untrusted module running in a separate thread does not mess with locks of the application, only at worst with its own locks, then Thread.stop might still be the best option.

Pro/cons of Thread.stop

  • (+) easy to use
  • (+) communication between trusted and untrusted code is easy
  • (-) deprecated
  • (-) possibly unsafe in some very specific situation that must be assessed first

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.