如何在JSP中保护第三方Taglib

Question

i'm thinking to extend my JSP-based WEB site with the option to customize it with dynamically user-loaded 3rd party tag libs. The question I have is what is the possible way to secure it within my WEB server, ie do not allow it do something like taking my passwords from local file system and send it somewhere to internet.

Is there some more-or-less standard approach for this?

I'm aware this can be done by customer SecurityManager (provided I have implemented my WEB server from scratch :)), but i have no idea what would be the way to plug in security manager into existing WEB server engine - for example Tomcat.

Answer 1

Tomcat supports use of a security manager. Just activate it on startup, using the -security command line option, and define your security policy in catalina.policy.