You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When allowExitFunctions is set to false, we can use the loadWithNewGlobal function to invoke the exit and quit methods to exit the Java process.
Code and the POC:
We have to turned off the loadWithNewGlobal method by executing var loadWithNewGlobal=function(){},but kept the load method.If the allLoadWithNewGlobal parameter can be added, security risks can be reduced. Thank you.
When
allowExitFunctionsis set to false, we can use theloadWithNewGlobalfunction to invoke theexitandquitmethods to exit the Java process.Code and the POC:
NashornSandbox sandbox = NashornSandBoxes.create();
sandbox.allowLoadFunctions(true);
sandbox.allowExitFunctions(false);
// POC
sandbox.eval("loadWithNewGlobal({name:\"test.js\", script: \"exit(1);\"});");Reported by liuxibin.
The text was updated successfully, but these errors were encountered: