title: How to execute a shell command securely as a web service
body: <p>SO I have a security dilemma.  </p>
  
  <p>Basically what I am doing is providing a web based translation service for a "Thousands of Problems for Theorem Provers" application.  I take a document written in <a href="http://ruleml.org/#PSOA" rel="nofollow">PSOA RuleML</a> language and translate it into <a href="http://www.cs.miami.edu/~tptp/TPTP/SyntaxBNF.html" rel="nofollow" title="TPTP FOF">TPTP-FOF</a>.</p>
  
  <p>To demonstrate this translation I want to provide two RESTful web services.  One to translate the PSOA RuleML and another to provide reasoning (<a href="http://code.google.com/p/psoa2tptp/downloads/list" rel="nofollow">initial report</a>).  </p>
  
  <p>The first service uses Java/ANTLR3/RestEasy and the second service uses Java/ApacheCommonsExec to test the generated TPTP Strings returned from the first service against the theorem prover.</p>
  
  <p>Does Apache Commons Exec provide sufficient security to do this?  I realize there are other obvious solutions e.g. compose the services, to ensure that only TPTP FOF sentences are tested.  But I would like to expose this theorem prover itself as a web service if possible any ideas SO.  Thanks in advance!</p>