Subj : Re: How to:  Limit package visibility to js scripts
To   : Mark Turansky <markturansky@hotmail.com>
From : Igor Bukanov <igor@fastmail.fm>
Date : Wed Nov 26 2003 12:10 pm

Mark Turansky wrote:
> Is it possible to limit how much java a javascript can script?
> 
> Unless I can limit package access to a script, I don't see much use for
> extending ScriptableObject.
> 
> For example, the ubiquitous User class....
> 
> //this fails!
> var user = new com.mycompany.User()    //doesn't know what 'com' is...
> 
> //this works!
> var user = java.lang.Class.forName("com.mycompany.User").newInstance();

You can also use:
new Packages.com.mycompany.User()

> 
> ------------------------
> 
> so, if I didn't want script writers to access the User object directly, I
> could extend ScriptableObject and make JSUser into a wrapper of User while
> limiting the methods exposed.
> 
> But if the script writer can access the class directly, what is the point?
> Can I cut-off what the script can do?  Can I turn off ALL java classes and
> only have the Context use the classes I feed it?

See
http://www.mozilla.org/rhino/apidocs/org/mozilla/javascript/Context.html#setClassShutter(org.mozilla.javascript.ClassShutter).

In partyicular, to disable ALL JS scripting of Java, use:

cx.setClassShutter(new ClassShutter())
{
	public boolean visibleToScripts(String fullClassName)
	{
		return false;	
	}
});

Regards, Igor

.