Scala / Java Sandbox for untrusted code

Question

I'd like to allow users to submit Java / Scala source code from browser client and compile / execute it on the server. However, at the same time, I want to restrict users from running potentially malicious code on server.

For instance, I would like to prevent filesystem access as well as inbound / outbound network access for submitted source code. What else should I restrict?

Which Java / Scala libraries should I explicitly disallow for client? For instance, here is my list of disallowed API's / libraries:

java.lang.System
java.lang.Runtime
java.io.*
java.nio.*
scala.io.*
java.net

How do I properly sandbox untrusted Java / Scala code?

Answer 1

The JVM runtime can be restricted by providing a policy file. Java unfortunately is not fullproof, so you would be wise to restrict the account running the JVM at the OS level.

If you are allowing the end user to compile scala code on your server then the compiler might execute macro code which is an additional attack surface. Scalac has probably not been designed to protect against malicious macros. Scalac runs within a JVM itself and could be similarly sandboxed.

This question is very close to yours.