Package org.codehaus.commons.compiler.sandbox
package org.codehaus.commons.compiler.sandbox
Restricts the APIs that compiled, untrusted code may use, by verifying the generated bytecode against an allowlist
before it is loaded (
SandboxPolicy), and limits the CPU time and the
memory that the code consumes (SandboxExecutor).-
ClassDescriptionVerifies that compiled classes use only the fields, methods and constructors that a
SandboxPolicyallows.A minimal parser for Java class files, as far as needed to determine which classes and members a class refers to.An entry of theBootstrapMethodsattribute.ACONSTANT_DynamicorCONSTANT_InvokeDynamicentry of the constant pool.A field or method declared by the class.ACONSTANT_Fieldref,CONSTANT_MethodreforCONSTANT_InterfaceMethodrefentry of the constant pool.The kinds of member references.ACONSTANT_MethodHandleentry of the constant pool.Enforces theSandboxLimitsof an execution by aSandboxExecutor.MakesGuardand the types of its signatures and exceptions (SandboxLimitExceededError,SandboxLimits), including their nested classes, visible to the code that JANINO instruments, even if the parent class loader cannot see them (e.g. because it is the platform class loader), and makes sure that the code uses the sameGuardclass as theSandboxExecutor.Identifies a field, method or constructor of a class, as it is subject to aSandboxPolicy.The kinds of members.Executes sandboxed code underSandboxLimits.Thrown bySandboxExecutor.call(java.util.concurrent.Callable)when an execution exceeded one of itsSandboxLimits.The resource limits for one execution of sandboxed code by aSandboxExecutor.CreatesSandboxLimits.The kinds of resource limits.An allowlist of the fields, methods and constructors that sandboxed code may use, and of the classes and interfaces that it may extend or implement.CreatesSandboxPolicys.A reason why aBytecodeVerifierrejected a class.Indicates that one or more classes were rejected by aBytecodeVerifier.