{"record":{"id":"3139f1ba04eae951","repo":"Konloch/bytecode-viewer","slug":"bcv-is-awesome-blocking-write","errorCode":null,"errorMessage":"BCV is awesome, blocking write(","messagePattern":"BCV is awesome, blocking write\\(","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java","lineNumber":387,"sourceCode":"                || file.endsWith(\".json\")\n                || file.endsWith(\".txt\")\n                || file.endsWith(\".log\"))\n                return;\n\n            //can only write into BCV dir\n            if (file.startsWith(Constants.BCV_DIR.getCanonicalPath()))\n                return;\n\n            //can only write into system temp\n            if (file.startsWith(Constants.SYSTEM_TEMP_DIRECTORY))\n                return;\n        }\n        catch (IOException e)\n        {\n            throw new SecurityException(e);\n        }\n\n        throw new SecurityException(\"BCV is awesome, blocking write(\" + file + \");\");\n    }\n}\n","sourceCodeStart":369,"sourceCodeEnd":390,"githubUrl":"https://github.com/Konloch/bytecode-viewer/blob/31430e0033fa220db566b5ef461256727ff6793b/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java#L369-L390","documentation":"SecurityMan.checkWrite throws SecurityException when code under BCV's sandbox attempts to write to a file that is not permitted; the final throw blocks the write and reports the file path. This prevents plugins or analyzed code from modifying arbitrary host files. Some permitted paths (e.g. BCV's own working outputs) pass through earlier,IOException wraps failures there.","triggerScenarios":"Plugin or analyzed code calls FileOutputStream/Files.write/etc. on a path not approved by SecurityMan's write policy while the SecurityManager is active.","commonSituations":"Plugins writing temp/output files outside allowed directories; analyzed libraries writing config or logs on first run; tools expecting to persist state anywhere on disk during analysis.","solutions":["Write only to BCV-sanctioned locations (its temp/working directory) from plugin code","Pre-create and use files under the allowed output directory instead of arbitrary paths","Adjust SecurityMan's write policy in a local build if a specific path must be writable","Avoid file I/O in analyzed code paths triggered during analysis"],"exampleFix":"// before\nnew FileWriter(\"/etc/mytool.cfg\"); // SecurityException\n// after\nFile out = new File(Configuration.getBCVDirectory(), \"mytool.cfg\");\nnew FileWriter(out); // inside BCV's permitted write area","handlingStrategy":"try-catch","validationCode":"File target = new File(path);\nString allowed = the.bytecode.club.bytecodeviewer.Configuration.getBCVDirectory();\nif (!target.getCanonicalPath().startsWith(new File(allowed).getCanonicalPath()))\n    throw new IllegalStateException(\"Write outside allowed BCV directory will be blocked: \" + target);","typeGuard":null,"tryCatchPattern":"try {\n    Files.write(target, data);\n} catch (SecurityException e) {\n    if (e.getMessage().startsWith(\"BCV is awesome, blocking write\")) {\n        // redirect to BCV's allowed output directory\n    } else throw e;\n}","preventionTips":["Write only under BCV's configured working/temp directory","Resolve and check canonical paths before writing","Avoid file persistence in code executed during analysis","Test all plugin I/O under BCV's SecurityManager"],"tags":["java","security","securitymanager","file-write","sandbox"],"backgroundTag":"write-blocked-by-securitymanager","analyzedSha":"31430e0033fa220db566b5ef461256727ff6793b","analyzedAt":"2026-09-05T18:22:22.725Z","contentChangedAt":"2026-09-05T18:22:22.725Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}