Why doesn't AllowClr function properly? Have I made any mistakes?

[KevinJin-Coder]

I am trying to integrate Jint into Unity.
The code is showed below:

using Jint.Runtime.Modules;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using UnityJavaScriptEngine.JavaScriptModuleLoaders;
using JavaScriptEngine = Jint.Engine;

namespace UnityJavaScriptEngine.JavaScriptComponents
{
public static class GlobalJavaScriptEngine
{
static JavaScriptEngine MJavaScriptEngine;

    public static JavaScriptEngine DefaultJavaScriptEngine
    => MJavaScriptEngine ??= CreateJavaScriptEngine();

    public static JavaScriptEngine JavaScriptEngineOverride;

    public static JavaScriptEngine Get()
    => JavaScriptEngineOverride ?? DefaultJavaScriptEngine;

    static JavaScriptEngine CreateJavaScriptEngine()
    {
        IModuleLoader moduleLoader = new AddressablesModuleLoader();
        IEnumerable<Assembly> assemblies = GetAssemblies();
        return JavaScriptEngineCreator.Create(moduleLoader, assemblies);
    }

    /// <summary>
    /// Returns all loaded assemblies except the Jint assembly, which is excluded by default
    /// for security reasons and because JavaScript code has no need to access
    /// the interpreter assembly itself.
    /// </summary>
    /// <returns>All assemblies in current app domain except the Jint assembly.</returns>
    static IEnumerable<Assembly> GetAssemblies()
    => AppDomain.CurrentDomain.GetAssemblies().Where(assembly =>
    {
        // Exclude the Jint assembly by default for security reasons.
        // Additionally, scripts have no need to access the JavaScript
        // interpreter assembly itself.
        AssemblyName assemblyName = assembly.GetName();
        return assemblyName.Name is not "Jint";
    });

    public static void RecreateJavaScriptEngine()
    => MJavaScriptEngine = CreateJavaScriptEngine();
}

}

and:

using Jint;
using Jint.Runtime.Modules;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using JavaScriptEngine = Jint.Engine;

namespace UnityJavaScriptEngine.JavaScriptComponents
{
public static class JavaScriptEngineCreator
{
public static JavaScriptEngine Create(IModuleLoader moduleLoader)
{
Options options = new Options()
.Strict()
.AllowClrWrite()
.AllowOperatorOverloading()
.CatchClrExceptions()
.EnableModules(moduleLoader);

        options.Interop.AllowGetType = false;
        options.Interop.AllowSystemReflection = false;
        return new(options);
    }

    public static JavaScriptEngine Create(IModuleLoader moduleLoader, bool enableDebug)
    {
        Options options = new Options()
        .Strict()
        .AllowClrWrite()
        .AllowOperatorOverloading()
        .CatchClrExceptions()
        .EnableModules(moduleLoader)
        .DebugMode(enableDebug);

        return new(options);
    }

    public static JavaScriptEngine Create(IModuleLoader moduleLoader, params Assembly[] assemblies)
    {
        Options options = new Options()
        .Strict()
        .AllowClrWrite()
        .AllowOperatorOverloading()
        .CatchClrExceptions()
        .EnableModules(moduleLoader)
        .AllowClr(assemblies);

        return new(options);
    }

    public static JavaScriptEngine Create(IModuleLoader moduleLoader, bool enableDebug, params Assembly[] assemblies)
    {
        Options options = new Options()
        .Strict()
        .AllowClrWrite()
        .AllowOperatorOverloading()
        .CatchClrExceptions()
        .EnableModules(moduleLoader)
        .AllowClr(assemblies)
        .DebugMode(enableDebug);

        return new(options);
    }

    public static JavaScriptEngine Create(IModuleLoader moduleLoader, IEnumerable<Assembly> assemblies)
    {
        Options options = new Options()
        .Strict()
        .AllowClrWrite()
        .AllowOperatorOverloading()
        .CatchClrExceptions()
        .EnableModules(moduleLoader)
        .AllowClr(assemblies.ToArray());

        return new(options);
    }

    public static JavaScriptEngine Create(IModuleLoader moduleLoader, bool enableDebug, IEnumerable<Assembly> assemblies)
    {
        Options options = new Options()
        .Strict()
        .AllowClrWrite()
        .AllowOperatorOverloading()
        .CatchClrExceptions()
        .EnableModules(moduleLoader)
        .AllowClr(assemblies.ToArray())
        .DebugMode(enableDebug);

        return new(options);
    }
}

}

Why am I still able to access Jint.Engine in the script, and even call functions like Jint.Engine.Evaluate or Jint.Engine.Execute, which can execute potentially harmful scripts?

Although the CreateJavaScriptEngine method is modified as follows:
static JavaScriptEngine CreateJavaScriptEngine()
{
IModuleLoader moduleLoader = new AddressablesModuleLoader();
// IEnumerable assemblies = GetAssemblies();
return JavaScriptEngineCreator.Create(moduleLoader, typeof(int).Assembly);
}

My whole thing still works while scripts are invoking something not in the typeof(int).Assembly.

[KevinJin-Coder]

I am attempting to implement a security boundary based on IModuleLoader by restricting the scripts that can be loaded.

[KevinJin-Coder]

The problem was tested in a clean environment and under the expected conditions. Perhaps it's because I made a more subtle mistake.

[lahma]

Short version: AllowClr(assemblies) doesn't restrict types to those assemblies — the list is additive. It's an extra place Jint looks up types, not a deny-everything-else boundary. Whenever CLR interop is enabled, scripts can always reach types from Jint's own assembly and from corelib (System.Private.CoreLib / mscorlib), no matter what you pass to AllowClr.

Why Jint.Engine resolves. importNamespace('Jint').Engine goes through NamespaceReference.GetPath, which tries several sources in order:

1. Jint's own executing/calling assembly (Assembly.GetExecutingAssembly() — always Jint.dll),
2. your Interop.AllowedAssemblies,
3. Type.GetType(path), which searches the calling assembly (Jint.dll again) and corelib.

Step 1 runs before your list, so any public Jint type (Jint.Engine, Jint.Options, …) resolves. Step 3 means every corelib type resolves too. Your list only adds assemblies on top of those — it can't take them away. That's why excluding Jint (or passing an empty/typeof(int).Assembly list) changes nothing about what's reachable.

Why the IModuleLoader boundary doesn't stop it. The System global and importNamespace function are installed on the global object whenever interop is enabled — completely independent of module loading. Restricting which modules can be imported doesn't touch them; a script can still call importNamespace(...) / System.* without importing anything.

The key point: CLR interop is not a security sandbox. This is bigger than the allow-list. Once CLR access is enabled, assume a script can reach the host process. Even with a strictly-enforced allow-list, other paths remain: corelib types via Type.GetType; .GetType() on any exposed CLR object (a System.Type reachable through any host property or return value bypasses the name-based AllowGetType filter); reflection from there (AllowSystemReflection only blocks the System.Reflection.* namespace at value-conversion time, not type resolution); and constructor/member walks over host object graphs you pass in. Setting AllowGetType = false and AllowSystemReflection = false (which you do in one overload, but not in the AllowClr(assemblies) one you actually use) narrows the surface but is not a boundary.

What to do. To run untrusted scripts safely, don't enable CLR at all — leave Interop.Enabled false (i.e. don't call AllowClr(...); note that AllowClr is what sets Interop.Enabled = true). Then System, importNamespace and CLR type resolution simply don't exist in the script. Expose only the specific host objects/functions the scripts genuinely need via engine.SetValue(...), and add the execution constraints (LimitMemory, MaxStatements, TimeoutInterval, LimitRecursion) for resource safety. If you do need some CLR access, treat the allow-list as "extra assemblies to make available," not as containment, and design your exposed surface assuming a script that reaches it can do anything that surface transitively allows.