Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: made the CS compile

...

Code Block
bgColor#ccccff
class ACC {

  private static class RestrictedAccessControlContext {
      private static final AccessControlContext INSTANCE;
  
    static {	      
          INSTANCE = new AccessControlContext(new ProtectionDomain[] {
               new ProtectionDomain[] { new ProtectionDomain(null, null) // No permissions
               });
    }
  }
  }

  
  
  private static void evalScript(final String firstName)
            throws ScriptException {
    ScriptEngineManager manager = new ScriptEngineManager();
    final ScriptEngine engine = manager.getEngineByName("javascript");
    // Restrict permission using the two-argument form of doPrivileged()
    try {
      AccessController.doPrivileged(
        new PrivilegedExceptionActionPrivilegedExceptionAction<Object>() {
                        
          public Object run() throws ScriptException {
            engine.eval("print('" + firstName + "')");		
            return null;
          }
    	
    }, RestrictedAccessControlContext.INSTANCE); // From nested class
                                                                    
        } catch (PrivilegedActionException pae) {
      	
      // Handle
     }   }
    }
}

This approach could be combined with whitelisting white-listing for extra security.

Applicability

...