不同包中的两个类如何隔离它们？
我们必须开发一个游戏，用户可以上传他们的代码，例如剪刀石头布。他们必须从接口类实现一些方法，我们在游戏类中调用它们，没什么特别的。
用户的代码在包中，我们没有名称冲突，
但回到主题：我们如何确保用户 A 不会调用用户 B 的类中的方法？
We have to develope a game, where the user can upload their code, for example Rock Paper Scissor. They have to implement some methods from an interface class and we call them in our game Class, nothing special.
The code of the users are in packages, that we have no name-collision,
but to the main topic: How we can ensure, that user A don't call methods from the class of user B ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
一种方法是在不同的类加载器中加载这两个类。为了完全安全，您还需要在安全沙箱中运行类，以阻止反射和其他可能绕过类加载器障碍的机制。
事实上，我认为这可能有一个缺陷。如果两个“玩家”类实现相同的接口，则它们可以多态地调用共享接口中定义的方法。事实上，它们是在不同的类加载器中加载的，因此不能使用彼此的类型，但这并不能阻止这一点。
因此，您本质上是依靠阻塞反射（和良好的编程）来防止一个类/对象找出另一个类/对象的实例。阻止反射还可以防止一个类破坏另一个类的封装，或者调用未在公共超类或共享接口中定义的方法。
One way to do this is to load the two classes in different class loaders. To be completely safe, you also need to run the classes in a security sandbox that stops reflection and other mechanisms that could get around the class loader barrier.
Actually, I think there might be a flaw in this. If the two "player" classes implement the same interface, they can polymorpically invoke methods defined in the shared interface. The fact that they are loaded in different class loaders and therefore can't use each others' types doesn't stop that.
So, you are essentially relying on blocking reflection (and good programming) to prevent one class/object ferreting out the instance of the other. Blocking reflection also prevents one class from breaking the other's encapsulation, or calling methods that are not defined in a common superclass or a shared interface.
这些都是猜测，但请注意：
或者，您可以让用户上传脚本而不是真正的 Java 代码，例如可以与 Rhino 一起运行的 ECMAScript 。
These are all guesses, but look to:
Alternatively, you could let users upload scripts instead of real Java code, e.g. ECMAScript which you can run with Rhino.
看看 http://download.oracle.com/javase/tutorial /java/javaOO/accesscontrol.html
Have a look at http://download.oracle.com/javase/tutorial/java/javaOO/accesscontrol.html
如果您在程序中包含并运行其他人的代码，则没有什么可以阻止他们调用您的方法。
您可以将您的方法包设为私有并密封包，等等，但您仍然需要处理反射等。
如果我在您那里，我会考虑通过明确定义的网络协议或通过标准与用户代码进行交互输入/输出。
If you include, and run some one elses code in your program, nothing prevents them from calling your methods.
You could make your methods package private and seal the packages, and so on, but you would still have to deal with reflection etc.
If I where you, I would consider interfacing with the user-code through a well defined network protocol or through standard input / output.
一种简单的方法是确保所有方法都受保护或默认访问修饰符，以便包外部的任何人都无法访问它们。
One simple way can be making sure that all methods have
protectedordefaultaccess modifier so that no one outside the package can access them.你不能，只要这些是公共方法，除非你隔离在不同的类加载器中，在这种情况下每个类不能互相看到。
在不同的类加载器中加载是 Web 容器（如 Tomcat、Jetty 等）隔离不同 Web 应用程序的方式。
另一种方法可能是设置自定义安全实现，但它比类加载器解决方案更难实现。
You can't, as long as those are public methods, unless you isolate in different class loaders, in which case each class cannot see each other.
Loading in different classloaders is how web containers, like Tomcat, Jetty etc.. isolate different web applications.
Another approach could be to setup a custom security implementation, but it's far harder to make it right than the classloader solution.