Secure Nashorn JS Execution

I asked this question on the Nashorn mailing list a while back: Are there any recommendations for the best way to restrict the classes that Nashorn scripts can create to a whitelist? Or is the approach the same as any JSR223 engine (custom classloader on the ScriptEngineManager constructor)? And got this answer from one of … Read more

Should I use a separate ScriptEngine and CompiledScript instances per each thread?

You can share a ScriptEngine and CompiledScript objects across threads. They are threadsafe. Actually, you should share them, as a single engine instance is a holder for a class cache and for JavaScript objects’ hidden classes, so by having only one you cut down on repeated compilation. What you can’t share is Bindings objects. The … Read more