title: How to restrict createObject() on certain java classes or packages?
body: <p>I want to create a secure ColdFusion environment, for which I am using multiple sandboxes configuration. The following tasks are easily achievable using the friendly administrator interface:  </p>
  
  <ul>
  <li>Restricting CFtags like: cfexecute, cfregistry and cfhttp.</li>
  <li>Disabling Access to Internal ColdFusion Java components.</li>
  <li>Access only to certain server and port ranges by third-party resources.</li>
  </ul>
  
  <p>And the others using configuration of the web server accordingly.</p>
  
  <h2>The Problem:</h2>
  
  <p>So I was satisfied with the setup only to encounter later that regardless of the restriction applied to the <code>cfexecute</code> tag one can use <code>java.lang.Runtime</code> to execute system files or scripts easily;</p>
  
  <pre><code>String[] cmd = {"cmd.exe", 'net stop "ColdFusion 10 Application Server"'};
  Process p = Runtime.getRuntime().exec(cmd);
  </code></pre>
  
  <p>or using the <code>java.lang.ProcessBuilder</code>:</p>
  
  <pre><code>ProcessBuilder pb = new ProcessBuilder("cmd.exe", 'net stop "ColdFusion 10 Application Server"');
  ....
  Process myProcess = pb.start();
  </code></pre>
  
  <p>The problem is that I cannot find any solutions which allows me to disable these two classes: <code>java.lang.Runtime</code> &amp; <code>java.lang.ProcessBuilder</code> for the <code>createObject()</code>.
  For the note: I have tried the file restriction in the sanbox and os permission as well, but unfortunately they seem to work on an I/O file operations only and I cannot mess with security policies of the system libraries as they might be used internally by ColdFusion.</p>