Is it possible for a Java JAR file to damage your system and how can you check what it's doing?

java security jar virus trojan
Benton picture Benton · Jan 23, 2011 · Viewed 19.7k times · Source

I want to evaluate a software solution where multiple people have submitted JAR files to perform a task on Windows.

Is it possible to check whether the JAR file performs any additional unwanted behaviors besides those it claims to perform on your machine?

Answer

nrobey picture nrobey · Jan 23, 2011

First, you can use a JVM set with SecurityManager to do run your application in a way that it can have limited access to sensitive functions.

You can also set up a "sandbox" so the jar cannot have permissions outside of the sandbox... you could use chroot or a similar tool in a linux/unix environment.

Related questions

Java Error: "Your security settings have blocked a local application from running"

I'm trying to run this simple HelloWorld code written in Java from my browser (Chrome): public class HelloWorld extends JApplet { public void init() { try { SwingUtilities.invokeAndWait(new Runnable() { public void run() { JLabel lbl = new JLabel("Hello World"); add(lbl); } }); } catch (…

Read More
Why is char[] preferred over String for passwords?

In Swing, the password field has a getPassword() (returns char[]) method instead of the usual getText() (returns String) method. Similarly, I have come across a suggestion not to use String to handle passwords. Why does String pose a threat to …

Read More
How to retrieve a file from a server via SFTP?

I'm trying to retrieve a file from a server using SFTP (as opposed to FTPS) using Java. How can I do this?

Read More