Konloch/bytecode-viewer · error · SecurityException

BCV is awesome! Blocking exec:

Error message

BCV is awesome! Blocking exec: 

What it means

SecurityMan.checkExec blocks Runtime.exec/ProcessBuilder launches initiated by code BCV does not consider safe. When allow, validClassCall, or the not-blocked check fails, it throws SecurityException("BCV is awesome! Blocking exec: " + cmd). This sandbox prevents plugins or analyzed code from executing arbitrary host commands.

Source

Thrown at src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java:172

        else if (canClassExecute(Thread.currentThread().getStackTrace()[7].getClassName()))
            validClassCall = true;
        else
        {
            int index = 0;
            for (StackTraceElement stackTraceElements : Thread.currentThread().getStackTrace())
            {
                System.out.println(index++ + ":" + stackTraceElements.getClassName());
            }
        }

        //log exec if allowed
        if (allow && validClassCall && !blocked)
        {
            if (silentExec.get() >= 1)
                System.err.println("Allowing exec: " + cmd);
        } //throw exception stopping execution
        else
            throw new SecurityException("BCV is awesome! Blocking exec: " + cmd);
    }

    /**
     * Class Whitelist goes here
     */
    private boolean canClassExecute(String fullyQualifiedClassName)
    {
        return fullyQualifiedClassName.equals(KrakatauDecompiler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(KrakatauDisassembler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(CFRDecompiler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(ProcyonDecompiler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(FernFlowerDecompiler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(JDGUIDecompiler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(KrakatauAssembler.class.getCanonicalName())
            || fullyQualifiedClassName.equals(ExternalResources.class.getCanonicalName())
            || fullyQualifiedClassName.equals(Enjarify.class.getCanonicalName())
            || fullyQualifiedClassName.equals(APKTool.class.getCanonicalName())
            || fullyQualifiedClassName.equals(BytecodeViewer.class.getCanonicalName())

View on GitHub (pinned to 31430e0033)

Solutions

1. Whitelist the calling class in SecurityMan's class whitelist (canClassExecute) if the exec is legitimate
2. If you are the plugin author, use APIs BCV permits or ask maintainers to add an allowlist entry
3. Avoid exec from plugin code; perform required processing in-Java instead of external processes
4. Run BCV outside the sandboxed configuration only in a trusted environment if you must exec

Example fix

// before (plugin code)
Runtime.getRuntime().exec("tool args"); // throws SecurityException
// after
// do the work with a Java library instead of shelling out, e.g.
ToolProcess.runInSandboxedContext("tool args"); // BCV-approved helper, or refactor to in-process API

if (!allowedCommands.contains(cmd))
    throw new IllegalStateException("Command will be blocked by BCV SecurityMan: " + cmd);

try {
    Runtime.getRuntime().exec(cmd);
} catch (SecurityException e) {
    if (e.getMessage().startsWith("BCV is awesome! Blocking exec:")) {
        // fall back to in-process implementation or notify user
    } else throw e;
}

When it happens

Trigger: Plugin or decompiled code calls Runtime.getRuntime().exec(...) / ProcessBuilder while the SecurityManager is active and the calling class is not whitelisted in canClassExecute, or the command is on the blocklist, or allow is false.

Common situations: Plugins shelling out to external tools (javac, git, etc.); libraries analyzed in BCV attempting to spawn processes; silent-exec allowance disabled so all exec attempts from non-whitelisted callers fail.

Related errors

• BCV is awesome, blocking System.exit(
• BCV is awesome, blocking write(
• BCV is awesome, blocking port
• Unknown constant pool tag ${tag}
• null key or factory

AI-assisted analysis of Konloch/bytecode-viewer@31430e0033 (2026-09-05). Data as JSON: /api/errors/dd814abd2dbbbb00. Report an issue: GitHub.