How can I safely run untrusted Java applications?

I am writing an autograder web application that accepts a program from the user as input. What are some ways to protect my web server from malicious software inputs?

Currently, only Java software inputs are supported. I am thinking of some disabling access to certain packages / classes, but I'm not sure how to do this.

Any ideas / suggestions?

+4
source share
1 answer

The easiest way to protect against unwanted malware is to simply run it in a separate virtual machine. If you are running Linux, boot the virtual machine using KVM or something else, run the program there and write the output file somewhere (for example, via the virtual serial port). Give the virtual machine no access to the network and wipe it every time.

Otherwise, Java has an extensive security and sandbox model, originally designed to isolate applets. However, this is difficult to use correctly, and I would not recommend using it for something like this: spawning a VM is much easier and safer.

+7
source

All Articles