how can i forbid a jar create new thread in java

Question

I have create a simple plugin system that allows others upload their plugin's jar, and the plugin system will load it and execute some code in it.

the plugin system will get a subclass of Function<Input, Output> to execute the loaded plugin logic, but I do not want that Function to create new Thread or do some danger action like System.exit. how can I forbid this action?

I have found the AccessController or SecurityManager in Java, how to use it to implement my intent.

Answer 1

Like you said, you can add a security Manager. Something like below: You can put your code in try catch block and catch your custom security exception thrown. This code below runs in loop and keeps on calling System.exit(1);

import java.security.Permission;

public class TestPreventSystemExit {

    public static void main(String[] args) {
        forbidSystemExitCall();
        while (true) {
            try {
                System.exit(1);
            } catch (Exception ex) {

            }
        }
    }

    private static class PreventExitException extends SecurityException {
    }

    private static void forbidSystemExitCall() {
        final SecurityManager securityManager = new SecurityManager() {
            public void checkPermission(Permission permission) {
                if (permission.getName().indexOf("exitVM") >= 0) {
                    System.out.println("Why you did this to me? :)");
                    throw new PreventExitException();
                }
            }
        };
        System.setSecurityManager(securityManager);
    }

}

Answer 2

For System.exit() - see the other answer.

For preventing the starting of threads: possible, but requires to extend the SecurityManager class - see here.

AccessController is more about how a client would write code that is potentially checked. It is not something that you, as the "owner" of the JVM can make usage of (see here). So it doesn't help with your problem.