Scriptify security is opt-in. By default, securityMode is disabled.

script.getSecurityManager().setSecurityMode(true);

When security mode is enabled, class and path access must be explicitly allowed through excludes.

booleangetSecurityMode();
voidsetSecurityMode(booleansecurityMode);
SecurityFileSystemgetFileSystem();
SecurityPathAccessorgetPathAccessor();
Set<SecurityExclude> getExcludes();
voidaddExclude(SecurityExcludeexclude);
voidremoveExclude(SecurityExcludeexclude);

Default implementation:

org.densy.scriptify.core.script.security.StandardSecurityManager

Allow a class:

script.getSecurityManager().addExclude(SecurityExclude.ofClass(java.time.Instant.class));

Allow a package prefix:

script.getSecurityManager().addExclude(SecurityExclude.ofPackage("java.time"));

Runtime behavior:

• GraalVM uses excludes for host class lookup.
• Rhino uses excludes through ClassShutter.

Set a base path:

script.getSecurityManager().getPathAccessor().setBasePath(Path.of("workspace"));

Allow a path prefix:

script.getSecurityManager().addExclude(SecurityExclude.ofPath("workspace/input"));

Security path access resolves paths against the configured base path and normalizes them.

When access is denied, SecurityFileSystem.getPath throws SecurityException.

Path security is used by Scriptify-provided file operations:

• existsFile;
• readFile;
• writeFile;
• deleteFile;
• moveFile;
• listFiles;
• downloadFromUrl;
• zip/unzip functions;
• GraalVM external file module resolution.

The standard and HTTP modules expose privileged operations:

Do not expose these to untrusted scripts unless you have reviewed the capabilities and configured security.

Create a narrow module instead of exporting StandardScriptModule.

SimpleScriptInternalModulesafe = newSimpleScriptInternalModule("safe");
safe.export(newScriptFunctionExport(newScriptFunctionPrint()));
script.getSecurityManager().setSecurityMode(true);
script.getModuleManager().setScriptAccess(ScriptAccess.EXPLICIT);
script.getModuleManager().addModule(safe);

Security mode restricts class/path access. Module design controls which Scriptify functions exist at all.

SecurityExclude.isExcluded uses prefix matching:

returnvalue.startsWith(this.getValue());

Use precise prefixes and normalize paths consistently.