4 ms·
Seems pretty wild that JEB would _default_ to just turning the sandbox off when `SecurityManager` is missing.
by JosephRedfern 4y ago
Seems pretty wild that JEB would _default_ to just turning the sandbox off when `SecurityManager` is missing.
- tetha 4y agoAgreed, I would have expected this to fail shut and require some flag to function. Inconvenient, but in this case, I'd prefer to be inconvenienced and safe rather than conveniently owned.
- UncleMeat 4y agoYeah. This should have been a HUGE INCREDIBLY LOUD FLASHING RED WARNING SIGN when they implemented the code execution feature. Like, "wait what if the in-built jvm sandboxing isn't available" should have been among the first questions. And it isn't too terribly difficult to implement your own sandboxed interpreter if you don't have access to the SecurityManager. Heck, SecurityManager has been basically a dead feature for ages. I'm stunned that JEB didn't start with a different solution.