Safeguarding untrusted Java code

Question

I have a server application that receives Java code downloaded from its clients, and then it needs to be processed in accordance with the method calls inside it.

My first thought was to compile it - run it, but when I thought about it well ... ding ding security. How can I limit the calls made to a particular code execution, for example: it can execute basic java-jazz (for loops, etc. etc.) to access important classes like Math and access some methods with my server, but without the possibility of harm or anything bad to the server.

Answer 1

. Oracle " " :

. "-Djava.security.policy", java.security.policy. ,

java -Djava.security.manager -Djava.security.policy=someURL SomeApp

someURL - URL-, , , .

, , :

permission java.io.FilePermission "/home/user/*", "read";

, !