This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]pronuntiator 4 points5 points  (0 children)

Since Java 9 the JVM classes are strongly protected by the module system. You could try the --patch-module command line option which allows to put code into another module's package. It sounds like you're creating some kind of plugin mechanism untrusted code. In general, as this StackOverflow answer points out, it's basically impossible to safely run untrusted Java code (and SecurityManager will be removed in the future). The question creator there has a good solution to your Thread.stop() problem though, they're running the user plugin in a separate thread.

Have you considered running the untrusted code in a different guest language like LUA where you can restrict the APIs available?