Disable Java reflection for the current thread

Question

I need to call some semi-trustworthy Java code and want to disable the ability to use reflection for the duration of that code\'s execution.

try{
   // disa         


        

Answer 1

Well, you can override SecurityManager.checkMemberAccess and give a stricter definition. However, it doesn't really work like that. What happens for instance if the code defines a finaliser?

On the clarification: Other APIs use reflection and other APIs. For instance, java.beans, LiveConnect and Rhino. An adversary could from within a script, say, create a new Rhino context without the shutter and thereby bootstrap into the full JRE. With an open system, a blacklist can never be finished.

In summary: to use the Java security model you need to work with it, not against it.