I am developing a game in java and plan to embed the Groovy script engine to allow for more robust modding options. This comes at a price, of course. Groovy can access anything java can by default, making it something of a security risk. At the moment, this doesn't worry me all too much, as mods for many other single player games such as minecraft already provide this level of access.

However, while the game does not currently have multiplayer support, I would very much like to change that at some point after the initial release. In this case, I would like to be able to allow servers to supply required mod files directly to the client. Is it safe to allow this sort interaction in any case?

My current plan of implementation for this would be to have the server supply mod files to clients, then have the clients pass the name of the mod to a public server I'd host, receiving back from me the expected hash value of that mod to compare against a locally computed hash of the files received from the client. They'd also be given the public rating and description of the mod, and be prompted from there if they wished to keep the mod or discard it.

Obviously this would still require me hosting a mod validation server, so that mods not on the server would be rejected by default. And I'd likely have to provide the ability to download mods directly from this server for users looking to get these mods in the first place, but the purpose of this is to allow players to easily connect to servers without planning out ahead of time what mods they'd need to download, while also decreasing some of the bandwidth overhead I'd have to deal with by having servers host the files and myself simply serving up short blocks of text and hashes.

In summary: Is this complete overkill? Can I even trust servers to host safe content? Can I trust servers to host safe content without checking up on the files they send? Is this not enough security? Do I need to sandbox groovy, or would I be wasting my time?


1 Answer 1


If the game downloads executable code of any fashion, you had better sandbox it completely. Many games don't, and as an ex-security guy, I give all such games an F.

I wouldn't worry about the server validating too much since the user has to make the option to trust any particular server in this instance.

You can get away with not sandboxing your scripts if you make sure you clearly inform users about the dangers of connecting to unknown servers and if you make it easy to opt-out of executing scripts after they've been downloaded (so users can easily check what scripts a server is sending without running them). Also, in this case, use end-to-end encryption (SSL/TLS) to prevent injection of malicious code.

It probably wont' matter in practice, but do you want to be responsible for stolen personal data? If you aren't going to put the user and their security and safety first, do not write networked code, or really any code at all for that matter. Don't be irresponsible just to save on some time and effort. Please.

  • \$\begingroup\$ Well, this is all about two years out from when I begin implementing it. Hopefully that inspires some confidence I'm not just trying to save time and effort and instead taking this seriously. At any rate, I was mostly trying to get a sense of how secure my plan of implementation was compared to acceptable standards. At any rate, you made a lot of good points. I hadn't yet considered encryption between the host and server, for some reason... About validating server-sent files: wouldn't this at least give the users a warning if the server is trying to provide a corrupt version of a good mod? \$\endgroup\$
    – Hawkwing
    Jul 19, 2013 at 14:37
  • \$\begingroup\$ You should trust your server, or don't host on them if you don't. \$\endgroup\$ Jul 19, 2013 at 15:57
  • \$\begingroup\$ I can trust my download server, sure. The question was how to help players decide if they should trust the files sent from the 3rd-party game server they are connecting to, or if that is far too big of a hole to try and patch. \$\endgroup\$
    – Hawkwing
    Jul 19, 2013 at 17:04
  • \$\begingroup\$ You can't. They either do or they don't. If you can download scripts, it's no different than downloading a .EXE from some random site. Either it's a site operated by people they trust or its not. Sandbox your scripts thoroughly so servers can't do any damage to the users' machines or data. You could build some kind of web of trust or authority, but maintaining that for a small game is going to be problematic, and you need tools then for "researchers" to download all content from a server and inspect it without running it, plus notices if content changes. Just sandbox. \$\endgroup\$ Jul 19, 2013 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .