access denied (java.lang.reflect.ReflectPermission suppressAccessChecks

Greetings. I'm trying to upgrade from the 1.3 beanshell to the latest
rev for all the latest and greatest. 

The app I work on allows the user to enter business logic by entering
java or perl code. 

I've been blundering through the security permissions needed by enabling
the debug, and thus far, the list looks like:


        // "standard" properies that can be read by anyone
        
        permission java.util.PropertyPermission "java.version", "read";
        permission java.util.PropertyPermission "java.vendor", "read";
        permission java.util.PropertyPermission "java.vendor.url",
        "read";
        permission java.util.PropertyPermission "java.class.version",
        "read";
        permission java.util.PropertyPermission "os.name", "read";
        permission java.util.PropertyPermission "os.version", "read";
        permission java.util.PropertyPermission "os.arch", "read";
        permission java.util.PropertyPermission "file.separator",
        "read";
        permission java.util.PropertyPermission "path.separator",
        "read";
        permission java.util.PropertyPermission "line.separator",
        "read";
        
        permission java.util.PropertyPermission
        "java.specification.version", "read";
        permission java.util.PropertyPermission
        "java.specification.vendor", "read";
        permission java.util.PropertyPermission
        "java.specification.name", "read";
        
        permission java.util.PropertyPermission
        "java.vm.specification.version", "read";
        permission java.util.PropertyPermission
        "java.vm.specification.vendor", "read";
        permission java.util.PropertyPermission
        "java.vm.specification.name", "read";
        permission java.util.PropertyPermission "java.vm.version",
        "read";
        permission java.util.PropertyPermission "java.vm.vendor",
        "read";
        permission java.util.PropertyPermission "java.vm.name", "read";
        
        permission java.util.PropertyPermission "debug", "read";
        permission java.util.PropertyPermission "debugClasses", "read";
        permission java.util.PropertyPermission "user.dir", "read";
        permission java.util.PropertyPermission "trace", "read";
        permission java.util.PropertyPermission "outfile", "read";
        permission java.util.PropertyPermission "localscoping", "read";
        
        permission java.lang.RuntimePermission "accessDeclaredMembers";
        permission java.lang.RuntimePermission "createClassLoader";
        

The script I'm running is really basic... It looks like this:

        public class JavaCode
        {
        public static Object run()
        {
        return(new String("Stuff"));
        }
        }
        

The problem I'm running into now is that something is bsh is requesting
to suppressAccessChecks something that I simply cannot allow, otherwise
a user could go on a wild stampede through variables in my system.

The exception I receive is 


        bsh.InterpreterError: Error in class gen setup:
        bsh.UtilTargetError: Security Exception while searching fields
        of: class JavaCode
                at bsh.ClassGeneratorImpl.generateClassImpl(Unknown
        Source)
                at bsh.ClassGeneratorImpl.generateClass(Unknown Source)
                at bsh.BSHClassDeclaration.eval(Unknown Source)
                at bsh.Interpreter.eval(Unknown Source)
                at bsh.Interpreter.eval(Unknown Source)
                at bsh.Interpreter.eval(Unknown Source)
        

however by turning on -Djava.security.debug=access,failure I get more
information:



boPlug
o


I'm having trouble getting 2.0 to work 

        access: access denied (java.lang.reflect.ReflectPermission
        suppressAccessChecks)
        java.lang.Exception: Stack trace
                at java.lang.Thread.dumpStack(Thread.java:1158)
                at java.security.AccessControlContext.checkPermission
        (AccessControlContext.java:253)
                at java.security.AccessController.checkPermission
        (AccessController.java:427)
                at java.lang.SecurityManager.checkPermission
        (SecurityManager.java:532)
                at java.lang.reflect.AccessibleObject.setAccessible
        (AccessibleObject.java:107)
                at bsh.reflect.ReflectManagerImpl.setAccessible
        (ReflectManagerImpl.java:59)
                at bsh.ReflectManager.RMSetAccessible
        (ReflectManager.java:78)
                at bsh.Reflect.findAccessibleField(Reflect.java:346)
                at bsh.Reflect.resolveExpectedJavaField
        (Reflect.java:299)
                at bsh.Reflect.getLHSStaticField(Reflect.java:212)
                at bsh.ClassGeneratorImpl.generateClassImpl
        (ClassGeneratorImpl.java:153)
                at bsh.ClassGeneratorImpl.generateClass
        (ClassGeneratorImpl.java:25)
                at bsh.BSHClassDeclaration.eval
        (BSHClassDeclaration.java:92)
                at bsh.Interpreter.eval(Interpreter.java:645)
                at bsh.Interpreter.eval(Interpreter.java:739)
                at bsh.Interpreter.eval(Interpreter.java:728)


I'm confused why all this is occurring through, as the class, and static
method are public and shouldn't need access checks suppressed to access
them. Is this a bug that everything is being suppressed?

I've tried this with the 2.0b4 jar and a 2.0b5 jar to no avail.

Is there something I could do in the source to hack around this problem,
or anything else I could do short of enabling suppressAccessChecks?

Thanks for your help,

Clint Goudie-Nice