title: Untrusted Groovy Script Security in Java
body: <p>We are attempting to provide scriptable elements with in an "enterprisy" product. We would like to use groovy but we are having difficulty securing very basic things.</p>
  
  <p>For example, we would like to prevent a client from simply going</p>
  
  <pre><code>Class.forName("my.company.internal.SecruityTools").runAsAwesome(...)
  </code></pre>
  
  <p>We've installed a security manager with a policy that only allows <code>accesDeclaredMembers</code> and have overwritten the <code>checkPackageAccess</code> method and only allow white listed packages. Unfortunately, the default classLoader chain appears to just bypass this, and load the class any how.</p>
  
  <p>It would seem like this is a fairly common / discussed problem, but I cannot for the life of me find a library or even a good blog post on how to lock down untrusted scripts with in the context of a much greater application.</p>
  
  <p>Has any one done this succesfully? Am I missing some fairly obvious posts / concepts? Is there already a solid library for this? Maybe <code>Groovy.tinFoilHatMode(true)</code>?</p>