How far should I go in securing Groovy mod scripts?

Question

I am developing a game in java and plan to embed the Groovy script engine to allow for more robust modding options. This comes at a price, of course. Groovy can access anything java can by default, making it something of a security risk. At the moment, this doesn't worry me all too much, as mods for many other single player games such as minecraft already provide this level of access.

However, while the game does not currently have multiplayer support, I would very much like to change that at some point after the initial release. In this case, I would like to be able to allow servers to supply required mod files directly to the client. Is it safe to allow this sort interaction in any case?

My current plan of implementation for this would be to have the server supply mod files to clients, then have the clients pass the name of the mod to a public server I'd host, receiving back from me the expected hash value of that mod to compare against a locally computed hash of the files received from the client. They'd also be given the public rating and description of the mod, and be prompted from there if they wished to keep the mod or discard it.

Obviously this would still require me hosting a mod validation server, so that mods not on the server would be rejected by default. And I'd likely have to provide the ability to download mods directly from this server for users looking to get these mods in the first place, but the purpose of this is to allow players to easily connect to servers without planning out ahead of time what mods they'd need to download, while also decreasing some of the bandwidth overhead I'd have to deal with by having servers host the files and myself simply serving up short blocks of text and hashes.

In summary: Is this complete overkill? Can I even trust servers to host safe content? Can I trust servers to host safe content without checking up on the files they send? Is this not enough security? Do I need to sandbox groovy, or would I be wasting my time?

Answer 1

If the game downloads executable code of any fashion, you had better sandbox it completely. Many games don't, and as an ex-security guy, I give all such games an F.

I wouldn't worry about the server validating too much since the user has to make the option to trust any particular server in this instance.

You can get away with not sandboxing your scripts if you make sure you clearly inform users about the dangers of connecting to unknown servers and if you make it easy to opt-out of executing scripts after they've been downloaded (so users can easily check what scripts a server is sending without running them). Also, in this case, use end-to-end encryption (SSL/TLS) to prevent injection of malicious code.

It probably wont' matter in practice, but do you want to be responsible for stolen personal data? If you aren't going to put the user and their security and safety first, do not write networked code, or really any code at all for that matter. Don't be irresponsible just to save on some time and effort. Please.