如何保护使用 javax.scripting 运行的脚本？
我正在使用 javax.scripting 添加对在服务器端运行任意用户上传的 JavaScript 的支持。显然我想保护这些脚本！
Rhino 本身有一个用于在运行时保护脚本的框架。但是，javax.scripting 的文档没有提及脚本可用的安全性、权限或限制类。那么，这是否只是 javax.scripting API 中的一个巨大漏洞，它没有提供一个框架来保护其执行的脚本？
我不想直接使用 Rhino，因为我最初尝试过，但在将 Java 实例暴露给正在运行的脚本时遇到了一些问题。 javax.scripting 框架（它在底层使用了 Rhino）使这个过程变得简单，并且还简化了在多线程服务器中运行脚本。
我想将可以在运行脚本中访问/实例化的 Java 类列入白名单。谁能指出我如何实现这一目标的示例或文档？
I am using javax.scripting to add support for running arbitrary user-uploaded JavaScripts on the server-side. Obviously I want to secure those scripts!
Rhino, on it's own, has a framework for securing scripts at runtime. The documentation for javax.scripting, however, doesn't mention security, permissions or restricting classes available to the script. So is this just a huge hole in the javax.scripting API that it doesn't offer a framework to secure scripts it executes?
I don't want to use Rhino directly because I originally tried that but had some problems exposing Java instances to the running script. The javax.scripting framework made it (which uses Rhino under the hood) made this trivial and also simplified running scripts in a multi-threaded server.
I would like to white-list Java classes that can be accessed/instantiated within the running script. Can anyone point me to an example or documentation on how to achieve this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
事实证明，
javax.scripting不提供安全框架。经过一番搜索后，我在 Google 的缓存中发现了一个文档，建议尝试使用 Java 的doPrivilegedAction框架，但经过一些实验，我无法阻止脚本打开套接字或访问文件系统。在我问这个问题后，我发现以前在 StackOverflow 上曾问过这个问题： 如何在沙箱中使用 Rhino for Java 运行 Javascript？ 在该页面上，它错误地表明 JDK6 中包含的 Rhino 已经解决了安全问题。正如我所指出的，我能够从脚本中打开套接字和其他有害操作。
最终我放弃了javax.scripting，直接嵌入Rhino。通过构建一个同时也是
ClassShutter的自定义ContextFactory，我能够轻松实现两个结果：java.lang.*和我的服务器层次结构中选定的几个类。CodeUtopia（我无法链接到它，因为作为一个新用户，我不允许在单个帖子中链接到多个页面；但它在其他 StackOverflow 帖子中链接到）对于描述 ClassShutter
ClassShutter< /code> 架构和 Rhino 自己的ContextFactoryAPI 页面描述了如何构建自定义ContextFactory。It turns out that
javax.scriptingdoes not offer a security framework. After some searching I found a document in Google's cache that suggested trying to use Java'sdoPrivilegedActionframework but after some experimentation, I was unable to get this to prevent the scripts from opening sockets or accessing the filesystem.After I asked this question I discovered it was previously asked here on StackOverflow: How can you run Javascript using Rhino for Java in a sandbox? On that page, it falsely indicates that the Rhino included in the JDK6 has security worked out already. As I indicated, I was able to open sockets and other harmful actions from the script.
In the end I abandoned
javax.scriptingand embedded Rhino directly. By building a customContextFactorythat is also aClassShutterI was able to achieve two results easily:java.lang.*and a select few classes in my server's hierarchy.CodeUtopia (which I can't link to because, as a new user, I'm not allowed to link to multiple pages in a single post; but it's linked in the other StackOverflow post) was valuable in describing the
ClassShutterarchitecture and Rhino's ownContextFactoryAPI page describes how to build a customContextFactory.http://codeutopia.net/blog/2009/01 /02/sandboxing-rhino-in-java/ 描述了一种沙箱 rhino 的方法，javax.scripting 使用 Rhino 作为 JS 脚本引擎，因此您应该能够使用上面的内容，尽管包名称可能有所不同。
http://codeutopia.net/blog/2009/01/02/sandboxing-rhino-in-java/ describes a way to sandbox rhino, and javax.scripting uses Rhino as the JS script engine so you should be able to use the above, though the package names might differ.
仅供参考，现在可以在 javax.scripting 的新 Java 8 实现中实现这一点，该实现使用名为 Nashorn 的新引擎。请参阅安全 Nashorn JS 执行
FYI, this is now possible in the new Java 8 implementation of javax.scripting which uses a new engine called Nashorn. See Secure Nashorn JS Execution