Securing game plugins / mods for java

Question

I am looking into using Java to write a game core, then writing the game logic separate either in Java, or using something like Python. This way I open up the ability for any future users to modify the game to their liking, similar to how TES or Torchlight 2 is setup.

However, my main concern is doing this securely. Looking at the Java option, I can't help but feel that this would allow nefarious users from accessing a lot more than would be safe (OS-level stuff, complete access to the user's file system, etc.). So I was hoping that there was some way of making sure that this isn't possible. Ideally I'd like to use something like Python, Lua, or Angelscript to reduce what the mod writer has access to, but I'm not sure how secure even this would be.

So I came here hoping that this is something dealt with on a regular basis, since I know it's a long shot but... I hope to get on Steam at some point, and I can't imagine Workshop support would allow unsafe code.

Answer 1

The Java Scripting Framework is what you need. It's a system which let's you register script engines in your java app (e.g. Groovy, Javascript), so you can pass control to an engine/script. It's used to create the flexible parts of a heavy-duty JEE application. So corporate users can customize your deployed application with individual scripts.

The following example is taken from the official Oracle page, you send a string to a script engine, which evaluates it and returns the result:

import javax.script.*;
public class EvalScript {
    public static void main(String[] args) throws Exception {
        // create a script engine manager
        ScriptEngineManager factory = new ScriptEngineManager();
        // create a JavaScript engine
        ScriptEngine engine = factory.getEngineByName("JavaScript");
        // evaluate JavaScript code from String
        engine.eval("print('Hello, World')");
    }

You can pass parameters to the script and there are many other possibilities - see the official docs.

As for security, you can use a SecurityManager with finely tuned policy files which grant specific rights to your script engine. E.g. calls like System.exit(-1); will not get executed.

An example policy file (just copied from https://db.apache.org/derby/docs/10.9/devguide/rdevcsecure871422.html) :

/* Grants permission to run Derby and access all      */
/* databases under the Derby system home              */
/* when it defaults to the current directory               */


grant codeBase "file://f:/derby/lib/derby.jar" {
  permission java.lang.RuntimePermission "createClassLoader";
  permission java.util.PropertyPermission "derby.*", "read";
  permission java.util.PropertyPermission "user.dir", "read";
  permission java.io.FilePermission "${derby.system.home}","read";
  permission java.io.FilePermission "${user.dir}${/}-",
      "read,write,delete";
  permission java.util.PropertyPermission "derby.storage.jvmInstanceId", 
      "write"; 

};

Answer 2

look at the security framework in java, which is the same framework that should prevent java web applets from deleting c:\windows\system32

for the scripting engine you can then decide exactly what the script has access to, do be careful because opening holes can have unintended consequences

Answer 3

There are various scripting languages for JVM, e.g. Lua (luaj) and Javascript (rhino). These are typically used to script things like games, and present the scripter only with functionality you chose to expose.