🌍 Language / Idioma / Língua / Langue / Язык / 语言
🇬🇧 English • 🇪🇸 Español • 🇧🇷 Português • 🇫🇷 Français • 🇷🇺 Русский • 🇨🇳 中文

This document provides detailed information about JDevTools' built-in security system.

JDevTools includes an enterprise-grade security system to protect your server from malicious code. The security scanner works in two phases:

Source Code → [AST Analysis] → Compilation → [Bytecode Verification] → Loading
                  ↓                              ↓
            Security Issues                Security Issues
                  ↓                              ↓
         BLOCK / WARN / ALLOW           BLOCK / WARN / ALLOW

• Remote Code Execution (RCE)
• Shell command execution
• JNDI injection (Log4Shell)
• Unsafe deserialization
• Native code loading (System.loadLibrary)
• Security manager bypass

• Thread.sleep() in main thread (causes lag)
• Network connections (potential data exfiltration)
• Aggressive reflection usage
• System.exit() calls

• Minor bad practices
• Deprecated API usage

Configure in config.yml:

security:
  level: MODERATE  # PARANOID, STRICT, MODERATE, PERMISSIVE

Create or edit security.yml for granular control:

# Whitelist specific classes/methods
whitelist:
  classes:
    - "com.myserver.TrustedUtil"
  methods:
    - "com.example.MyClass.safeMethod"

# Blacklist custom patterns
blacklist:
  patterns:
    - "dangerousPattern"

# Trust specific plugin authors
trusted-authors:
  - "Kazen"

# Advanced options
advanced:
  allow-reflection: false      # Allow Class.forName, Method.invoke
  allow-networking: false      # Allow Socket, URL connections
  allow-file-io: true          # Allow file read/write
  allow-native-code: false     # Allow System.loadLibrary
  scan-dependencies: true      # Scan downloaded JARs
  verify-bytecode: true        # Post-compilation verification
  max-issues-before-block: 10  # Block after N HIGH issues

JDevTools scans dependencies for known vulnerabilities:

/jd cve update

Security reports are saved to plugins/JDevTools/security-reports/ and include:

• Detected issues with severity
• Line numbers in source code
• Recommended fixes
• Overall risk score

If you absolutely need to use blocked code:

1. Whitelist specific classes in security.yml
2. Set level to PERMISSIVE (warnings only)
3. Use JVM flag (requires confirmation file):

   -Djdev.unsafe=true
   

   Plus create file UNSAFE_MODE_CONFIRM.txt with content:

   I_UNDERSTAND_THIS_DISABLES_ALL_SECURITY_<port>
   

⚠️ WARNING: Disabling security puts your server at risk. Only do this if you fully understand the code being compiled.

Q: The security scanner blocked my legitimate code. What do I do?

A: Add the specific class or method to your whitelist in security.yml. Only whitelist code you fully trust.

Q: Can I disable the security scanner completely?

A: Yes, but it's strongly discouraged. Set security-level: PERMISSIVE in config.yml. The scanner will only warn, not block.

Q: Does the scanner slow down compilation?

A: Minimally. AST analysis adds ~100-200ms to compilation time.

Q: What happens when a threat is detected?

A: Depending on severity and your security level, JDevTools will either:

• BLOCK: Stop compilation and log the issue
• WARN: Continue but log a warning
• ALLOW: Continue silently

For more help, open a GitHub Issue - Discord coming soon!