I just thought I would throw out a little issue I "discovered" when trying to use the javax.scripting API. By "discovered" I mean read the documentation

It does not appear possible to use Java security with the javax.scripting implementation, specifically when dealing with a script that is interpreted without being loaded from a particular location.
For example, with the native Groovy interface, you can do something like this:
1 2 3
| String script="println('Hello World');"; GroovyCodeSource src = new GroovyCodeSource(script,"someScript", "/sandbox"); new GroovyShell().parse(src); |
Where "/sandbox" is a codebase you can configure via a java.security.policy like
1 2 3
| grant codeBase "file:/sandbox" { }; |
With the javax.scripting API, there is no way to specify a codebase in which you would like a random script to executed. This may or may not be a problem depending on who you want to have access to scripting of course.