package net.md_5.bungee;

import java.security.AccessControlException;
import java.security.Permission;
import java.util.logging.Level;
import net.md_5.bungee.api.ProxyServer;

public class BungeeSecurityManager extends SecurityManager
{

    private static final boolean ENFORCE = false;

    private void checkRestricted(String text)
    {
        Class[] context = getClassContext();
        for ( int i = 2; i < context.length; i++ )
        {
            ClassLoader loader = context[i].getClassLoader();

            // Bungee can do everything
            if ( loader == ClassLoader.getSystemClassLoader() )
            {
                break;
            }

            // Everyone but system can't do anything
            if ( loader != null )
            {
                AccessControlException ex = new AccessControlException( "Plugin violation: " + text );
                if ( ENFORCE )
                {
                    throw ex;
                }

                ProxyServer.getInstance().getLogger().log( Level.WARNING, "Plugin performed restricted action, please inform them to use proper API methods: " + text, ex );
                break;
            }
        }
    }

    @Override
    public void checkExit(int status)
    {
        checkRestricted( "Exit: Cannot close VM" );
    }

    @Override
    public ThreadGroup getThreadGroup()
    {
        checkRestricted( "Thread Creation: Use scheduler" );
        return super.getThreadGroup();
    }

    @Override
    public void checkPermission(Permission perm)
    {
        switch ( perm.getName() )
        {
            case "setSecurityManager":
                throw new AccessControlException( "Restricted Action", perm );
        }
    }
}

@@ -652,32 +652,316 @@
 %0A            %7D%0A%0A
+            // Allow external packages from the system class loader to create threads.%0A            if ( loader == null )%0A            %7B%0A                if ( !context%5Bi%5D.getName().startsWith( %22java.lang%22 ) )%0A                %7B%0A                    break;%0A                %7D%0A            %7D%0A%0A
             // E
@@ -1037,32 +1037,78 @@
 )%0A            %7B%0A
+                System.out.println( loader );%0A
                 

Fix #1106 - plugins using ssl throwing exceptions