Question about security risk #225
Unanswered
LoganFievez
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi,
I'm analysing a way to give users of the app I'm currently working on the possibility to execute some simple scripts.
By testing, a bunch of different use cases I've noted something: I can load any java package with LuaJava, which means (I assume, I didn't test it yet) I can do anything I want like maybe get a connection to the database or access the file system.
Is there a way to limit the imports the users can do ? For example, I only accept type based classes such as Integer, BigDecimal, etc.
Thank you.
Beta Was this translation helpful? Give feedback.
All reactions