Class BytecodeVerifier

java.lang.Object
org.codehaus.commons.compiler.sandbox.BytecodeVerifier
public final class BytecodeVerifier extends Object
Verifies that compiled classes use only the fields, methods and constructors that a SandboxPolicy allows.

For each class, the verifier checks

  • its superclass and interfaces (see SandboxPolicy.isSubclassingAllowed(String)),
  • that it declares no native methods,
  • that it declares no finalize() method (which the JVM would call outside of any SandboxExecutor),
  • every field and method reference in its constant pool (including those referenced by method handles), and
  • the bootstrap method of every invokedynamic instruction and dynamically-computed constant.

Each field and method reference is resolved as the JVM would resolve it (JVMS 5.4.3), and the policy is applied to the declaring class of the resolved member. Members declared by the verified classes themselves are always allowed, as are the members that compilers reference implicitly for language features like string concatenation, autoboxing, enhanced FOR statements, ASSERT statements, enums, lambdas and records, and the resource limit checks of Guard. References that cannot be resolved are rejected.

Pure type references (e.g. for casts, instanceof, class literals and array creation) are not checked, because they do not execute any code of the referenced type.

  • Constructor Details

    • BytecodeVerifier

      public BytecodeVerifier(SandboxPolicy policy)
      Parameters:
      policy - The policy to verify classes against

  • Method Details

    • verify

      public List<SandboxViolation> verify(Map<String,byte[]> classes, ClassLoader hostClassLoader)
      Verifies a set of classes that were compiled together, e.g. all classes generated by one compilation.
      Parameters:
      classes - The class files to verify; the keys are ignored (they may be class names like "pkg.Foo" or resource names like "pkg/Foo.class")
      hostClassLoader - Loads the classes that the verified classes refer to (other than themselves); typically the parent class loader of the class loader that will define the verified classes
      Returns:
      All violations, ordered by source file and line (violations without a line number first); empty if the classes comply with the policy
      Throws:
      ClassFormatError - One of the classes is not a valid class file

    • verify

      public List<SandboxViolation> verify(Map<String,byte[]> classes, ClassLoader definingClassLoader, Map<String,byte[]> pendingClasses)
      Verifies classes that a class loader is about to define, typically a class loader that compiles classes on demand (like a JavaSourceClassLoader), and thus defines the generated classes one at a time.

      Classes that the definingClassLoader has already defined, and the pendingClasses, are regarded as generated classes, like the classes themselves; i.e. their members are allowed, and they may be extended. This is safe as long as the class loader verifies every class before it defines it.

      Parameters:
      classes - The class files to verify; the keys are ignored
      definingClassLoader - The class loader that will define the classes; classes that the verified classes refer to (other than themselves and the pendingClasses) are loaded through it
      pendingClasses - Class name => class file; classes that the definingClassLoader generated, but has not yet defined
      Returns:
      All violations, ordered by source file and line (violations without a line number first); empty if the classes comply with the policy
      Throws:
      ClassFormatError - One of the classes is not a valid class file