Re: JEP411: Missing use-case: Security Manager and Java Scripting (JSR 223)

2021-07-22 Thread Alexey Shponarsky
Hi Sean, We are using Rhino 1.7.12 On Wed, Jul 21, 2021 at 10:31 PM Sean Mullan wrote: > Hi, > > I am not an expert in JSR 223. However, some JSR 223 implementations > include a mechanism for restricting access to Java classes, for example > Nashorn [1] and Rhino [2], which might be sufficient

Re: JEP411: Missing use-case: Security Manager and Java Scripting (JSR 223)

2021-07-21 Thread Peter Firmstone
JEP 411 is quite a conundrum for downstream developers that depend on SM. SecurityManager has its problems, but it's the only authorization layer we have. If I had a complaint about SM, it's the implementation of: 1. SocketPermission doesn't allow netmask wild cards. 2. Thread inherited Acces

Re: JEP411: Missing use-case: Security Manager and Java Scripting (JSR 223)

2021-07-21 Thread Sean Mullan
Hi, I am not an expert in JSR 223. However, some JSR 223 implementations include a mechanism for restricting access to Java classes, for example Nashorn [1] and Rhino [2], which might be sufficient for your needs. (Note, Nashorn was deprecated and removed from JDK 15 [3]). I think most of the

JEP411: Missing use-case: Security Manager and Java Scripting (JSR 223)

2021-07-21 Thread Alexey Shponarsky
Hello, At Jelastic PaaS, we are using SecurityManager within Java Scripting (JSR 223). Specifically, Java Scripting allows us and our customers to easily extend the core platform functionality with custom logic. The developers can execute their custom scriptlets inside a Java Scripting runtime env