Secure Nashorn JS Execution

user_1779093 0
Viewed 15982

How can I securely execute some user supplied JS code using Java8 Nashorn?

The script extends some computations for some servlet based reports. The app has many different (untrusted) users. The scripts should only be able to access a Java Object and those returned by the defined members. By default the scripts could instantiate any class using Class.forName() (using .getClass() of my supplied object). Is there any way to prohibit access to any java class not explicitly specified by me?

nashorn javascript java
9 Answers

Without the use of Security Manager it is not possible to securely execute JavaScript on Nashorn.

In all releases of Oracle Hotspot that included Nashorn one can write JavaScript that will execute any Java/JavaScript code on this JVM. As of January 2019, Oracle Security Team insist that use of Security Manager is mandatory.

One of the problems is already discussed in https://github.com/javadelight/delight-nashorn-sandbox/issues/73

user_6231440
Related