Disable libraries in Java?

Question

Assume I have a webpage where people submit java source code (a simple class). I want to compile and run the code on my server, but naturally I want to prevent people from harming my server, so how do I disable java.io.* and other functions/libraries of my choice?

A regexp on the source code would be one way, but it would be "nicer" if one could pass some argument to javac or java.

(This could be useful when creating an AI competition or something where one implements a single class, but I want to prevent tampering with the java environment.)

Answer 1

If you are in complete control of the JVM, then you can use security policies to do this. It's the same approach taken by web browsers when they host applets.

http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html

Hope this helps.

Answer 2

Depending on your intent, you might be able to speak with Nick Parlante, who runs javabat.com - it does pretty much exactly what you're describing. I don't know whether he's willing to share his solution, but he might be able to give you some specific help.