org.netbeans.libs.graalsdk

Class GraalSDK

java.lang.Object

org.netbeans.libs.graalsdk.GraalSDK

public final class GraalSDK
extends Object

Integration of NetBeans Scripting API and GraalVM; see the tutorial for more details.

Security

By default all the GraalVM engines (named GraalVM:something) run in a very restricted, secure sandbox:

private static final HostAccess SANDBOX = HostAccess.newBuilder().
        allowPublicAccess(true).
        allowArrayAccess(true).
        allowListAccess(true).
        allowAllImplementations(true).
        denyAccess(Class.class).
        denyAccess(Method.class).
        denyAccess(Field.class).
        denyAccess(Proxy.class).
        denyAccess(Object.class, false).
        build();

The languages cannot access local files, ports, etc. They can access public fields and public methods of objects passed into their scripts (but not those methods exposed by base Object class). The scripts can access elements of Java arrays and List elements. Methods of a functional interfaces are callable by the scripts.

For some languages such restrictions are too tight. They need to gain wider access. This can be done by setting allowAllAccess attribute to true:

// FastR currently needs access to native libraries:
final ScriptEngineManager manager = Scripting.newBuilder().allowAllAccess(true).build();
ScriptEngine rEngine = manager.getEngineByMimeType("application/x-r");

Once enabled, the HostAccess.ALL and allowAllAccess(true) is then used to construct the engine's environment.

Polyglot API Access

As a consequence of packaging the GraalVM APIs, it is possible to request this module and gain access to org.graalvm.polyglot package directly. Consult Context and Engine classes as a starting points when accessing the Graal SDK directly. Preferably use only if the NetBeans Scripting API wrapper isn't good enough.

Method Summary

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait