Assuming we are talking about an interpreter rather than generated code. With a SecurityManager
installed, privileges can be reduce by having a policy that reduces permissions of the interpreter code.
If you use the two-argument forms of java.security.AccessController.doPrivileged
, then there are issues with calling methods that check the immediate caller and ignore anything passed that (for example, AccessController.doPrivileged
).
Obviously hosting untrusted code exposes a huge attack surface. You can hide some of your own code by using class loaders which are peers of one another in the class loader hierarchy. The security property package.access is also useful (although you still need separate class loaders).
SecurityManager
can stop the app from usingSystem.exit()
. The purpose is not to protect the app against itself but the system against the app. @green a Java interpreter with a limited set of functionality or some kind of sourcecode preprocessor that replaces bad methods with something ok@{Runtime r = Runtime.getRuntime();... r.exit(1)}
. It's hard for the template engine to do static analysis on the code and prevent the last statementr.exit(1)
. A runtime security mechanism is needed I think