...
The best defense against code injection vulnerabilities is to avoid including executable user input in code. When dynamic code requires user input, that input must be sanitized. For example, a top-level method could ensure that the string firstName contains only valid, whitelisted characters. Refer to the guideline IDS01-J. Sanitize data passed across a trust boundary for more details. If special characters are allowed in the name, they must be escaped before comparing with their equivalent forms.
A complementary policy is to create a secure sandbox using a security manager. (See guideline SEC58-J. Create a secure sandbox using a Security Manager.) This approach is akin to the one discussed in the first compliant solution of guideline VOID IDS10-J. Prevent XML external entity attacks. The application should not allow the script to execute arbitrary commands including, for example, querying the local file system. The two-argument form of doPrivileged() can be used to lower privileges when the application must operate with higher privileges but the scripting engine must not. The RestrictedAccessControlContext strips the permissions granted in the default policy file by reducing the permissions granted to the newly created protection domain. The effective permissions are the intersection of the permissions of the newly created protection domain and the systemwide security policy. Refer to the guideline VOID SEC00-J. Avoid granting excess privileges for more details on the two-argument form.
...