Existing apis/libraries to compile/run java code?

Question

I'm trying to add a java scripting option to my web application with the following requirements:

1-The user writes custom java code.

2-The user can compile/run this code.

3-The user can upload jars and use them in his code (without using a custom class loader/reflection).

By overriding the java class loader, I managed to achieve the first 2 requirements. However, for the 3rd requirement, I am unsure how to proceed.

I was wondering if there was a way to use an existing api to handle this, or any offline java code compilers to execute this custom code:

input: java code+ dependent jars -> output: code execution

Answer 1

There is no way to dynamicly load additional JARs from the user without creating a new ClassLoader instance. But it doesn't necessarily need to be a custom subclass of ClassLoader .

The general idea is that you create a new instance of (say) URLClassLoader providing the URLs for (say) a local copy of the user's JARs. This new classloader would typically have your application's classloader as its parent classloader. Then you would use the new classloader to load the user's classes; ie the ones you wanted to user. You would need to reflection to create instances of those classes, and then you could cast them to an interface in your app's code-base and invoke methods on them as per a normal class.

Offline compilation won't help. The problem you need to solve is getting your application to >>load<< the user's code.

---

Warning: what you are proposing to do sounds rather dangerous. You have no real control over the code that the user is going to put into the Java source code or JAR. It could potentially do all sorts of malicious things: reading / writing your server's files, exfiltrating data, mining bitcoins, causing your server to participate in a DDOS. Or just do something that is annoying and disruptive.

That potentially malicious coder is going to run within your webapp on your server .