Is there a way to execute unsafe code (disable security manager) in Java?

Question

Please do not send an answer saying, "You must not do this." I do not plan to use this in production code, but only for some hackers.

Answering this question , I wanted to run some arbitrary unsafe Java code for fun. This code includes searching for only Java TreeMap leaf nodes.

Executing the code below results in

 Exception in thread "main" java.lang.SecurityException: Prohibited package name: java.util 

According to this question, I can use System.setSecurityManager(null) to get around most of these limitations. But I cannot do this, because an error appears when my class is loaded.

I already know that I can do whatever I want using reflection after disabling the security manager. But that will make the code much uglier. How do major Java developers write their unit tests, for example, if they cannot package things in java.util ?

I also tried -Djava.security.manager=... , but this causes a JVM initialization error when I set it to null , and I'm not sure what else I can install. Any ideas?

 package java.util; import java.util.TreeMap.Entry; public class TreeMapHax { static <K,V> List<Entry<K, V>> getLeafEntries(TreeMap<K, V> map) { Entry<K, V> root = map.getFirstEntry(); while( root.parent != null ) root = root.parent; List<Entry<K,V>> l = new LinkedList<Entry<K,V>>(); visitInOrderLeaves(root, l); return l; } static <K,V> void visitInOrderLeaves(Entry<K, V> node, List<Entry<K, V>> accum) { if( node.left != null ) visitInOrderLeaves(node.left, accum); if( node.left == null && node.right == null ) accum.add(node); if( node.right != null ) visitInOrderLeaves(node.right, accum); } public static void main(String[] args) { TreeMap<String, Integer> map = new TreeMap<String, Integer>(); for( int i = 0; i < 10; i++ ) map.put(Integer.toString(i), i); System.out.println(getLeafEntries(map)); } } 

Answer 1

there is no ordinary way to just answer your question

classes in java. * not limited by the security manager, they are limited by the class loader.

what you want, you somehow need to find a way to hack jvm. or just do what you mentioned, do it with reflection. or just create a copy (source clone) of the treemap in your own package.

Answer 2

If you create a custom java.lang.SecurityManager with all the protected logic and compile it into a custom JVM, you should be able to reference it after setting your java.security.manager property to your user manager.

Since the property is read by Launcher before starting your program, you should have your own SecurityManager in the JVM-supported class path, and not your own program (for example, attached to the main rt.jar file).

To answer the question of how the main developers deal with this: these tests are most likely to run against a custom JVM, because they do not comply with the traditional security of the JVM production. One example of such a stub can be found here .

Answer 3

I think you can try creating a jar for your custom Java package and put it in $ JRE_HOME / lib / ext and see the magic !!