1

I am trying frantically to run a programming competition over on the Code Golf Stack Exchange. I wrote a small control program that pits animals against each other on a game board. The animals are mostly Java classes (CrazyWolf.java, SuicideWolf.java, etc.), written by other people.

Those guys find so many loopholes in a competition that it will make your head spin. Some of them are starting to write Wolves that use reflection to cripple the competition before the simulation even begins.

I look at this from two standpoints.

  • Can I protect classes in the same package against reflection?
  • Can the competitors themselves protect their own Wolf against reflection?

With regard to the first question, the closest answer I could find on Stack Overflow was this one, which addresses restricting access to other packages. All of the wolves inherit from the same Animal class, so the class has to be accessible.

With regard to the second question, I found nothing. It seems like reflection just tramples over everything I thought I knew about private and even final variables. I did manage to find an article about tricking the compiler into replacing static final variables with a constant that won't be affected by reflection, but it seems unreliable and requires fields to be static and final.

What methods can I use to solve this? I am using Java 8 and NetBeans 7.4.

Community
  • 1
  • 1
Rainbolt
  • 3,542
  • 1
  • 20
  • 44

1 Answers1

1

The easiest way to do this is to run in a protected sandbox mode and have the security manager shut down reflection completely.

Some of the answers here may help:

Disable Java reflection for the current thread

Community
  • 1
  • 1
Tim B
  • 40,716
  • 16
  • 83
  • 128
  • I linked to this answer in my question, but perhaps I didn't put enough effort into understanding what it said. I'll look at it again. You have at least given me some good terminology to search for. – Rainbolt Apr 09 '14 at 14:26
  • Ahh yes, you linked to the answer not question so I didn't see it was the same. At its simplest try just running your code as an Applet, that will already amp the security level up enough to stop a lot of exploits. At its more complicated then google the security manager and how to configure it. – Tim B Apr 09 '14 at 14:32