Is it possible for a Java source file to run arbitrary code when compiled?

Question

Is it possible for me to structure a Java source file such that, when compiled with javac (but not invoked with java ) it will run arbitrary code?

Or can I assume that it's safe to run arbitrary source files through javac ?

Answer 1

I've never actually used this feature, but javac can run annotation processors -- which I believe are jut arbitrary code. The processors have to be in the processor path, which by default is just the user class path. So depending on your use case, I think that yes, this is a security concern to watch out for. You'll probably want to make sure annotation processing is disabled with -proc:none , or take some other precaution.

See the Annotation Processing section of the Javac manual .

Answer 2

It is not possible for javac to execute Java, regardless of how the source files are set up. All it is going to do is compile java files into class files.