Subj : ClassShutter is never asked
To   : netscape.public.mozilla.jseng
From : superilu
Date : Tue Feb 01 2005 03:37 am

Hi,

I tried to disable the Java access for Rhino 1.6r1.
The following code does not work:
public class JsTest {
    private static String s = 
        "out.println(\"This works\");"+
        "new java.lang.Thread();"+
        "fos = new java.io.FileOutputStream(\"e:/test.file\");"+
        "fos.write(32);"+
        "fos.write(65);"+
        "fos.write(66);"+
        "fos.write(67);"+
        "fos.close();"+
        "";

    private static class MyShutter implements ClassShutter {
        public boolean visibleToScripts(String fullClassName) {
            System.err.println(">>> denying "+fullClassName);
            return false;
        }
    }
    
    public static void main(String[] args) {
        Context ctx = new Context();
        Context.enter();
        ctx.setClassShutter(new MyShutter());
        try {
            Scriptable scope = ctx.initStandardObjects();
            Object wrappedOut = Context.javaToJS(System.out, scope);
            ScriptableObject.putProperty(scope, "out", wrappedOut);
            Object result = ctx.evaluateString(scope, s, "<cmd>", 0, null);
            System.out.println(result);
        } finally {
            Context.exit();
        }
    }
}
The file is created and no error raised? Any ideas?

regards
  Ilu

.