Q:

java expression language that can't access 'unsafe' java methods

I am working on a project where I will let users submit small 'scripts' to the server, and I will execute those scripts.  There are many scripting languages which can be embedded into a Java program, such as mvel, ognl, uel, clojure, rhino javascript, etc., but, as far as I can tell, they all allow script writer to call Java constructors, static methods, etc.
I don't want my users to be able to call anything which I don't provide them (usually through some sort of context object).  Most of their scripts will be arithmetic and logical expressions, in some cases they will need to traverse object properties (getters/setters) or contents of a Map.  I just don't want them to escape the sandbox I provide them.
Any suggestions?

A:

I think you can achieve this through using a security policy.

