在服務器上部署Spring應用程序時啓動Nashorn時出現安全錯誤

Question

我有一個Spring Web應用程序在啓動時會在啓動時引發一些令人困惑的錯誤，當我將它部署到生產服務器時（它們在本地運行時不會發生）似乎沒有影響任何事情，所以這個問題更多的是出於好奇而不是真正需要幫助。

這裏是堆棧跟蹤：

20-Apr-2016 17:31:31.711 INFO [localhost-startStop-1] org.apache.catalina.loader.WebappClassLoaderBase.loadClass Security Violation, attempt to use Restricted Class: jdk.internal.dynalink.support.messages_en_US 
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessClassInPackage.jdk.internal.dynalink.support") 
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) 
    at java.security.AccessController.checkPermission(AccessController.java:884) 
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) 
    at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1564) 
    at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1268) 
    at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1167) 
    at java.util.ResourceBundle$Control.newBundle(ResourceBundle.java:2640) 
    at java.util.ResourceBundle.loadBundle(ResourceBundle.java:1501) 
    at java.util.ResourceBundle.findBundle(ResourceBundle.java:1465) 
    at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1361) 
    at java.util.ResourceBundle.getBundle(ResourceBundle.java:1082) 
    at java.util.logging.Logger.findResourceBundle(Logger.java:1879) 
    at java.util.logging.Logger.setupResourceInfo(Logger.java:1940) 
    at java.util.logging.Logger.<init>(Logger.java:380) 
    at java.util.logging.LogManager.demandLogger(LogManager.java:554) 
    at java.util.logging.Logger.demandLogger(Logger.java:455) 
    at java.util.logging.Logger.getLogger(Logger.java:553) 
    at jdk.internal.dynalink.support.Guards.<clinit>(Guards.java:101) 
    at jdk.nashorn.internal.runtime.Undefined.<clinit>(Undefined.java:51) 
    at jdk.nashorn.internal.runtime.JSType.<clinit>(JSType.java:263) 
    at jdk.nashorn.internal.runtime.AccessorProperty.<clinit>(AccessorProperty.java:60) 
    at jdk.nashorn.internal.objects.Global.$clinit$(Global.java) 
    at jdk.nashorn.internal.objects.Global.<clinit>(Global.java:919) 
    at jdk.nashorn.internal.runtime.Context.newGlobal(Context.java:1102) 
    at jdk.nashorn.api.scripting.NashornScriptEngine$2.run(NashornScriptEngine.java:347) 
    at jdk.nashorn.api.scripting.NashornScriptEngine$2.run(NashornScriptEngine.java:343) 
    at java.security.AccessController.doPrivileged(Native Method) 
    at jdk.nashorn.api.scripting.NashornScriptEngine.createNashornGlobal(NashornScriptEngine.java:343) 
    at jdk.nashorn.api.scripting.NashornScriptEngine.<init>(NashornScriptEngine.java:143) 
    at jdk.nashorn.api.scripting.NashornScriptEngineFactory.getScriptEngine(NashornScriptEngineFactory.java:148) 
    at javax.script.ScriptEngineManager.getEngineByName(ScriptEngineManager.java:238) 
    at com.my.applicationlib.security.ScriptSandbox.<init>(ScriptSandbox.java:60) 
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) 
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) 
    at java.lang.reflect.Constructor.newInstance(Constructor.java:422) 
    at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:147) 
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:89) 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$4.run(AbstractAutowireCapableBeanFactory.java:1089) 
    at java.security.AccessController.doPrivileged(Native Method) 
    ... 

，相關代碼如下：

@Service 
public class ScriptSandbox { 
    ScriptEngine _scriptEngine; 
    AccessControlContext _accessControlContext; 

    public ScriptSandbox() throws InstantiationException{ 
     ScriptEngineManager sem = new ScriptEngineManager(); 
     _scriptEngine = sem.getEngineByName("nashorn");//This error happens on this line. 
     if (_scriptEngine==null){ 
      throw new InstantiationException("Could not load script engine: "+ 
        "nashorn"); 
     } 
     setPermissions(null); 
    } 
} 

我一直沒能打開在谷歌多的相關信息，最讓我」我看到的是我在我的java安全配置中需要它。我看起來像這樣，所以我認爲我有我需要的東西：

grant {permission java.security.AllPermission; permission java.lang.RuntimePermission;}; 

有什麼想法？

編輯：這個問題被標記爲this question.重複我不認爲這是由於以下原因：

，當我在它似乎工作的應用程序後初始化犀牛它工作得很好。我只能從我所知道的bean定義中得到這個錯誤。不要認爲這是一個簽名問題，因爲它只出現在bean定義上。

此外，該問題沒有被接受的答案和幾票。這些問題實際上是解決方案嗎？

Answer 1

對於什麼是值得的，我繞過這個方式我不是超級高興。由於我只在一個服務中使用過，所以我完全刪除了服務註釋，並使用@PostConstruct方法調用它進行初始化。我仍然想知道爲什麼在Spring的bean創建階段這不起作用。

@Service 
public class MyServiceThatUsesScriptSandbox(){ 
    private ScriptSandbox sandbox; 
    @PostConstruct 
    public void initSandbox(){ 
     sandbox = new ScriptSandbox(); 
    } 
}