How to remove java apis from Nashorn-engine?

Question

Is it possible to hide or remove java api's from nashorn-engine? So that it could only see or use "default" ECMAScript 262 Edition 5.1 with some especially exposed functions / variables?

I would like to let my endusers create some specific logic for their own without worrying they could hack the whole system. Of course there might be some security holes in the nashorn engine etc. but that is the different topic.

Edit: Sorry I forgot to mention that I am running nashorn inside my java application, so no commandline parameters can be used.

score 11 · Answer 1 · answered Jun 28 '14 at 19:53

Programmatically, you can also directly use the NashornScriptEngineFactory class which has an appropriate getScriptEngine() method:

import jdk.nashorn.api.scripting.NashornScriptEngineFactory;
...
NashornScriptEngineFactory factory = new NashornScriptEngineFactory();
...
ScriptEngine engine = factory.getScriptEngine("-strict", "--no-java", "--no-syntax-extensions");

pasuna · Accepted Answer · 2014-06-29T21:08:54.090

OK, here is sample class with some limiting arguments:

package com.pasuna;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Random;
import javax.script.Invocable;
import javax.script.ScriptEngine;
import javax.script.ScriptException;
import jdk.nashorn.api.scripting.NashornScriptEngineFactory;

public class ScriptTest {

    public static class Logger {
        public void log(String message) {
            System.out.println(message);
        }
    }

    public static class Dice {
        private Random random = new Random();
        public int D6() {
            return random.nextInt(6) + 1;
        }
    }

    public static void main(String[] args) {
        NashornScriptEngineFactory factory = new NashornScriptEngineFactory();
        ScriptEngine engine = factory.getScriptEngine(new String[]{"-strict", "--no-java", "--no-syntax-extensions"});
        //note final, does not work.
        final Dice dice = new Dice();
        final Logger logger = new Logger();
        engine.put("dice", dice);
        engine.put("log", logger);
        engine.put("hello", "world");
        try {

            engine.eval("log.log(hello);");
            engine.eval("log.log(Object.keys(this));");

            engine.eval("log.log(dice.D6());"
                    + "log.log(dice.D6());"
                    + "log.log(dice.D6());");

            engine.eval("log.log(Object.keys(this));");
            engine.eval("Coffee"); //boom as should
            engine.eval("Java"); //erm? shoud boom?
            engine.eval("log = 1;"); //override final, boom, nope
            engine.eval("log.log(hello);"); //boom
        } catch (final ScriptException ex) {
            ex.printStackTrace();
        }
        BufferedReader br = new BufferedReader(new InputStreamReader(System.in));
        String input = "";
        do {
            try {
                input = br.readLine();
                engine.eval(input);
            } catch (final ScriptException | IOException se) {
                se.printStackTrace();
            }
        } while (!input.trim().equals("quit"));

        try {
            engine.eval("var add = function(first, second){return first + second;};");
            Invocable invocable = (Invocable) engine;
            Object result = invocable.invokeFunction("add", 1, 2);
            System.out.println(result);

        } catch (final NoSuchMethodException | ScriptException se) {
            se.printStackTrace();
        }
        Object l = engine.get("log");
        System.out.println(l == logger);
    }
}

more info about flags can be found from here: http://hg.openjdk.java.net/jdk8/jdk8/nashorn/rev/eb7b8340ce3a

(imho atm the nashorn documentation is poor)

score 3 · Answer 3 · answered Jun 28 '14 at 13:40

3

You can specify any jjs option for script engines via -Dnashorn.args option when you launch your java program. For example:

java -Dnashorn.args=--no-java Main

where Main uses javax.script API with nashorn engine.

answered Jun 28 '14 at 13:40

A. Sundararajan

4,277
1
15
30

3

is there a way to do this programmatically? This can be forgotten and results can be bad. I totally forgot: Properties props = System.getProperties(); props.setProperty("nashorn.args", "-strict --no-java --no-syntax-extensions"); – pasuna Jun 28 '14 at 15:14

score 1 · Answer 4 · answered Jun 28 '14 at 13:14

1

You can run "jjs" tool with --no-java option to prevent any explicit Java package/class access from scripts. That said Nashorn platform is secure and uses Java standard URL codebase based security model ('eval'-ed script without known URL origin is treated like untrusted, unsigned code and so gets only sandbox permissions.

answered Jun 28 '14 at 13:14

A. Sundararajan

4,277
1
15
30

thank you, but I think that flag is not usable when you include nashorn inside your java application – pasuna Jun 28 '14 at 13:21

score 1 · Answer 5 · answered Jun 28 '14 at 13:14

1

--no-java is the main flag to turn off java extensions. --no-syntax-extensions turns off non-standard extensions.

answered Jun 28 '14 at 13:14

wickund

1,077
9
13

thank you, but I think that flag is not usable when you include nashorn inside your java application – pasuna Jun 28 '14 at 13:21

How to remove java apis from Nashorn-engine?

5 Answers5

Linked