4

I want to interpret html pages scripts, but want to disable any posibility of harming my computer. Is there are any official tutorial or example how to configure such feature? (i dont find it in offcial site)

yura
  • 14,489
  • 21
  • 77
  • 126

3 Answers3

6

run an initial script like this:

java = undefined;
Packages = undefined;
org = undefined;
...

then it is sandboxed.

chacko
  • 5,004
  • 9
  • 31
  • 39
  • Is there a comprehensive, up to date list somewhere of objects we need hide like this to effectively sandbox a script? – svidgen Apr 19 '14 at 18:42
4

I haven't seen any official example, but see this SO question and particularly this article on sandboxing in Rhino. The article gives a pretty good overview of the things you'll have to set up and guard against.

Community
  • 1
  • 1
fizban
  • 597
  • 5
  • 12
2

Beware reflection "out.println('outclass ' + out.getClass().forName('java.io.File'));"

There are many traps to this trade. Previous answer not good enough.

Tuntable
  • 3,276
  • 1
  • 21
  • 26