{"record":{"id":"dd814abd2dbbbb00","repo":"Konloch/bytecode-viewer","slug":"bcv-is-awesome-blocking-exec","errorCode":null,"errorMessage":"BCV is awesome! Blocking exec: ","messagePattern":"BCV is awesome! Blocking exec: ","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java","lineNumber":172,"sourceCode":"        else if (canClassExecute(Thread.currentThread().getStackTrace()[7].getClassName()))\n            validClassCall = true;\n        else\n        {\n            int index = 0;\n            for (StackTraceElement stackTraceElements : Thread.currentThread().getStackTrace())\n            {\n                System.out.println(index++ + \":\" + stackTraceElements.getClassName());\n            }\n        }\n\n        //log exec if allowed\n        if (allow && validClassCall && !blocked)\n        {\n            if (silentExec.get() >= 1)\n                System.err.println(\"Allowing exec: \" + cmd);\n        } //throw exception stopping execution\n        else\n            throw new SecurityException(\"BCV is awesome! Blocking exec: \" + cmd);\n    }\n\n    /**\n     * Class Whitelist goes here\n     */\n    private boolean canClassExecute(String fullyQualifiedClassName)\n    {\n        return fullyQualifiedClassName.equals(KrakatauDecompiler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(KrakatauDisassembler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(CFRDecompiler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(ProcyonDecompiler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(FernFlowerDecompiler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(JDGUIDecompiler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(KrakatauAssembler.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(ExternalResources.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(Enjarify.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(APKTool.class.getCanonicalName())\n            || fullyQualifiedClassName.equals(BytecodeViewer.class.getCanonicalName())","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/Konloch/bytecode-viewer/blob/31430e0033fa220db566b5ef461256727ff6793b/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java#L154-L190","documentation":"SecurityMan.checkExec blocks Runtime.exec/ProcessBuilder launches initiated by code BCV does not consider safe. When allow, validClassCall, or the not-blocked check fails, it throws SecurityException(\"BCV is awesome! Blocking exec: \" + cmd). This sandbox prevents plugins or analyzed code from executing arbitrary host commands.","triggerScenarios":"Plugin or decompiled code calls Runtime.getRuntime().exec(...) / ProcessBuilder while the SecurityManager is active and the calling class is not whitelisted in canClassExecute, or the command is on the blocklist, or allow is false.","commonSituations":"Plugins shelling out to external tools (javac, git, etc.); libraries analyzed in BCV attempting to spawn processes; silent-exec allowance disabled so all exec attempts from non-whitelisted callers fail.","solutions":["Whitelist the calling class in SecurityMan's class whitelist (canClassExecute) if the exec is legitimate","If you are the plugin author, use APIs BCV permits or ask maintainers to add an allowlist entry","Avoid exec from plugin code; perform required processing in-Java instead of external processes","Run BCV outside the sandboxed configuration only in a trusted environment if you must exec"],"exampleFix":"// before (plugin code)\nRuntime.getRuntime().exec(\"tool args\"); // throws SecurityException\n// after\n// do the work with a Java library instead of shelling out, e.g.\nToolProcess.runInSandboxedContext(\"tool args\"); // BCV-approved helper, or refactor to in-process API","handlingStrategy":"try-catch","validationCode":"if (!allowedCommands.contains(cmd))\n    throw new IllegalStateException(\"Command will be blocked by BCV SecurityMan: \" + cmd);","typeGuard":null,"tryCatchPattern":"try {\n    Runtime.getRuntime().exec(cmd);\n} catch (SecurityException e) {\n    if (e.getMessage().startsWith(\"BCV is awesome! Blocking exec:\")) {\n        // fall back to in-process implementation or notify user\n    } else throw e;\n}","preventionTips":["Never shell out from plugin code; prefer Java libraries","Check BCV's exec whitelist before relying on external tools","Document required exec commands so maintainers can whitelist them","Test plugins under BCV's SecurityManager before release"],"tags":["java","security","securitymanager","exec-blocked","sandbox"],"backgroundTag":"exec-blocked-by-securitymanager","analyzedSha":"31430e0033fa220db566b5ef461256727ff6793b","analyzedAt":"2026-09-05T18:22:22.725Z","contentChangedAt":"2026-09-05T18:22:22.725Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}