title: How to block access to some classes, when executing groovy scripts from java?
body: <p>I'm pretty new to groovy, and scripting in java generally, and I really
  hope there is a simple solution for my problem.
  In our application, the users can execute groovy scripts which they write
  themselves, and we need to control what those scripts can and can not do.
  I read a lot of stuff about sandboxing groovy, but either I am looking at
  wrong places or I am overlooking the obvious.
  To make it simple, I have a small example which demonstrates the problem.
  This is my class loader which should prevent <code>java.lang.System</code> from being
  loaded and available to scripts:</p>
  
  <pre><code>public class MyClassLoader extends ClassLoader {
  
      @Override
      public Class&lt;?&gt; loadClass(String name) throws ClassNotFoundException {
          if (name.startsWith("java.lang.System")) {
              throw new ClassNotFoundException("Class not found: " + name);
          }
          return super.loadClass(name);
      }
  }
  </code></pre>
  
  <p>And this is a simple program that tries to call <code>System.currentTimeMillis()</code>:</p>
  
  <pre><code>public static void main(String[] args) {
      String code = "java.lang.System.currentTimeMillis();";
      ClassLoader classLoader = new MyClassLoader();
      Thread.currentThread().setContextClassLoader(classLoader);
  
      GroovyShell shell = new GroovyShell();
      Script script = shell.parse(code);
      Object result = script.run();
      log.debug(result);
  }
  </code></pre>
  
  <p><code>MyClassLoader</code> throws exceptions for <code>java.lang.SystemBeanInfo</code>
  and <code>java.lang.SystemCustomizer</code>, but the code executes.
  Same thing happens if I use <code>javax.script</code> classes:</p>
  
  <pre><code>ScriptEngineManager factory = new ScriptEngineManager();
  ScriptEngine engine = factory.getEngineByName("Groovy");
  Object o = engine.eval(code);
  log.debug(o);
  </code></pre>
  
  <p>And if I try it with JavaScript engine, it works as expected (just replace
  "Groovy" with "JavaScript" in the above example).</p>
  
  <p>Can anyone help me with this? BTW, I'm using groovy-all-1.8.8.jar, with
  jdk1.7.0_55.</p>
  
  <p>Thanks</p>