title: Why can you execute Java-Code from a JS-ScriptEngine eval(String)?
body: <p>After setting up a JavaScript-ScriptEngine like this:</p>
  
  <pre><code>import javax.script.ScriptEngineManager;
  import javax.script.ScriptEngine;
  import javax.script.ScriptException;
  
  
  public class Compute {
  
    public static void main(String[] args){
      try{
  
        ScriptEngineManager mgr = new ScriptEngineManager();
        ScriptEngine engine = mgr.getEngineByName("JavaScript");
  
        System.out.println(engine.eval(args[0]));
      } 
      catch(Exception e){
        System.out.println("Syntax Error!");
      }
    }
  
  }
  </code></pre>
  
  <p>Why can you do things like:
      <em>java Compute 
      "java.util.Arrays.toString(new java.io.File(\".\").listFiles())"</em></p>
  
  <p>Isn't the ScriptEngine for "JavaScript" supposed to execute JS only?</p>
  
  <p>Any links on what the Engine actually does or why this is possible, would be greatly appreciated.</p>
  
  <p>(edit: This is no duplicate of <a href="https://stackoverflow.com/questions/1878052/security-problem-with-java-scriptengine">security problem with Java ScriptEngine</a>, as I want to know why this is possible, not how to avoid it)</p>