title: How java security doPrivileged method is blocking arbitrary scripts
body: <p>I have implemented a class as shown below,</p>
  
  <pre><code>class Example4 {
    private static class RestrictedAccessControlContext {
      private static final AccessControlContext INSTANCE;
  
      static {
        INSTANCE = new AccessControlContext(
                     new ProtectionDomain[] {
                       new ProtectionDomain(null, null) // No permissions
                     });
      }
    }
  
    private static void evalScript(final String input)
        throws Exception {
      ScriptEngineManager manager = new ScriptEngineManager();
     ScriptEngine engine = new ScriptEngineManager().getEngineByName("nashorn");
      // Restrict permission using the two-argument form of doPrivileged()
      try {
        AccessController.doPrivileged(
          new PrivilegedExceptionAction&lt;Object&gt;() {
  
            public Object run() throws Exception {
              engine.eval(new FileReader(new File(input)));
              return null;
            }
          },
          // From nested class
          RestrictedAccessControlContext.INSTANCE);
  
      } catch (PrivilegedActionException pae) {
        // Handle error
      }
    }
  </code></pre>
  
  <p>and I'm passing below script as an argument to the main method which can create multiple files inside the system.</p>
  
  <pre><code>var fImport = new JavaImporter(java.io.File); 
  
  i=0;
  while(true)
  {
       with(fImport) { var f = new File('new'+i); 
       f.createNewFile(); 
       i++;
  }
  }
  </code></pre>
  
  <p>So allowing such classes in the system is obviously a bad practice but in cert it has been suggested as a best practise to use a class like this
  (<a href="https://www.securecoding.cert.org/confluence/display/java/IDS52-J.+Prevent+code+injection" rel="nofollow">Click here to see the examples</a>). So how this doPrivileged method is providing protection to the system against executing arbitrary scripts ?
  and what are the changes I need to make in my code to prevent this file creation(Best Practise)</p>