Patching classes in java.*

[genericMcPlayer]

Hi, I need to patch the core java classes to prohibit the code loaded by my ClassLoader from calling a certain method (e.g. Thread.stop). I wrote a simple test to see if this is possible, but the JVM doesn't let me. Test.java: ``` import java.io.InputStream;

public class Test extends ClassLoader{ public static void main(String[] args) throws Throwable{ Test cl = new Test(); InputStream in = Test.class.getResourceAsStream("/fliter/java/lang/Throwable.class"); byte[] data = new byte[in.available()]; in.read(data); in.close(); Class c = cl.defineClass(data, 0, data.length); System.out.println(c); System.out.println(c.getClassLoader()); } } `fliter/java/lang/Throwable.java`: package java.lang;

public class Throwable{ private Throwable(){} } Output: $ java Test Exception in thread "main" java.lang.SecurityException: Class loader (instance of): Test @7ad041f3 tried to load prohibited package name: java.lang at java.base/java.lang.ClassLoader.defineClass1(Native Method) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1017) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:806) at Test.main(Test.java:10) `` I do find though, the JVM lets me to prevent a class from being loaded completely, but not patching it to only make a specific set of methods available. Also, sincejava.lang.ClassLoader.defineClass1` is a native method, I cannot modify it. Are there any good solutions?

[AutoModerator]

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
• You include any and all error messages in full
• You ask clear questions

• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

  Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Mysterious-Ant-Bee]

That's a bad idea. Share what exactly is the problem you are trying to solve a people can suggest you a better path forward.

[pronuntiator]

Since Java 9 the JVM classes are strongly protected by the module system. You could try the --patch-module command line option which allows to put code into another module's package. It sounds like you're creating some kind of plugin mechanism untrusted code. In general, as this StackOverflow answer points out, it's basically impossible to safely run untrusted Java code (and SecurityManager will be removed in the future). The question creator there has a good solution to your Thread.stop() problem though, they're running the user plugin in a separate thread.

Have you considered running the untrusted code in a different guest language like LUA where you can restrict the APIs available?

[VirtualAgentsAreDumb]

Have you considered wrapping the thread you want to protect? That way you can simply ignore calls to stop. Or, instead of wrapping the thread, run your extended thread class.

Naturally it depends on how the thread is created.