Disable arbitrary Java Execution in LUA

[KevinGuancheDarias]

Hello, first of all, great, interesting project, is it possible to disable the java.import() , and all those which allows any lua script to run any arbitrary java?.

My use case is to use luajava as a sandbox for a safe plugins system, so then I define some lua functions that invoke java code such as

myproject.player.do_something();

Where do_something() would call a Java Code that I defined, but the plugin can NOT do something like

PlayerClazz = java.import("myproject.PlayerClazz")
admin = java.new(PlayerClazz,1)
admin:setAdmin(1)
admin.deleteWorld()

Thanks in advance 🍷

[gudzpoz]

You might want to read #125 (comment) and the linked article (lua-users wiki: Sand Boxes) first.

Precautions from the article:

WARNING!!!

Sandboxing is tricky and generally speaking difficult to get right [3]. [...]

Instead of disabling java.import from this library, if you aim to provide a sandbox, you should definitely try to follow the article above and use loadstring + setfenv or load(..., env) to prevent scripts from doing other arbitrary things.