I am developing a game in java and plan to embed the Groovy script engine to allow for more robust modding options. This comes at a price, of course. Groovy can access anything java can by default, making it something of a security risk. At the moment, this doesn't worry me all too much, as mods for many other single player games such as minecraft already provide this level of access.
However, while the game does not currently have multiplayer support, I would very much like to change that at some point after the initial release. In this case, I would like to be able to allow servers to supply required mod files directly to the client. Is it safe to allow this sort interaction in any case?
My current plan of implementation for this would be to have the server supply mod files to clients, then have the clients pass the name of the mod to a public server I'd host, receiving back from me the expected hash value of that mod to compare against a locally computed hash of the files received from the client. They'd also be given the public rating and description of the mod, and be prompted from there if they wished to keep the mod or discard it.
Obviously this would still require me hosting a mod validation server, so that mods not on the server would be rejected by default. And I'd likely have to provide the ability to download mods directly from this server for users looking to get these mods in the first place, but the purpose of this is to allow players to easily connect to servers without planning out ahead of time what mods they'd need to download, while also decreasing some of the bandwidth overhead I'd have to deal with by having servers host the files and myself simply serving up short blocks of text and hashes.
In summary: Is this complete overkill? Can I even trust servers to host safe content? Can I trust servers to host safe content without checking up on the files they send? Is this not enough security? Do I need to sandbox groovy, or would I be wasting my time?