Home/ Questions/Q 5931437
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T14:41:40+00:00

If I evaluate a Javascript code submitted from the browser, on the server (Java

  • 0

If I evaluate a Javascript code submitted from the browser, on the server (Java webapp using Rhino Javascript Engine), does it pose security risk?

The Evaulation of the Javascript is being done only to know if its a valid Javascript.

I don’t expect the evaluation to return me anything. I don’t expect it store anything, or touch anything. All it should do is tell me is the user submitted valid javascript.

If it is something that poses security issues, can I take some steps to make sure that the JavaScript will not cause any harm to the system?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, it poses a security risk, because from JavaScript inside Rhino it’s possible to access anything in the Java runtime, including (for example) all the java.io classes.

    You can make sure that all your calls to Rhino operate under the jurisdiction of a SecurityManager that restricts basically everything. With the JDK’s ScriptEngine code there’s no built-in way to do that; I don’t know about what tools are available for Rhino as used with the Mozilla hooks.

    • 0