build(distribution): re-enable SecurityManager in distributions runni…

…ng under Java 18 and above (#5091)

facades/PC/src/main/startScripts/unixStartScript.gsp

@@ -169,6 +169,13 @@ save () {
 }
 APP_ARGS=`save "\$@"`
 
+# Terasology-specific changes - Re-enable SecurityManager on Java 18+
+# According to https://openjdk.org/jeps/223, this string is intentionally parsable.
+JAVA_VERSION=`java -fullversion 2>&1 | sed 's/.* //;s/"//;s/\\([0-9]*\\)\\..*/\\1/'`
+if [ \$JAVA_VERSION -gt 17 ]; then
+    DEFAULT_JVM_OPTS="\$DEFAULT_JVM_OPTS -Djava.security.manager=allow"
+fi
+
 # Collect all arguments for the java command, following the shell quoting and substitution rules
 eval set -- \$DEFAULT_JVM_OPTS \$JAVA_OPTS \$${optsEnvironmentVar} <% if ( appNameSystemProperty ) { %>"\"-D${appNameSystemProperty}=\$APP_BASE_NAME\"" <% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "\"\$MODULE_PATH\"" <% } %>-jar lib/Terasology.jar "\$APP_ARGS"
 

facades/PC/src/main/startScripts/windowsStartScript.bat.gsp

@@ -62,6 +62,14 @@ goto fail
 
 <% if ( mainClassName.startsWith('--module ') ) { %>set MODULE_PATH=$modulePath<% } %>
 
+@rem Terasology-specific changes - Re-enable SecurityManager on Java 18+
+@rem According to https://openjdk.org/jeps/223, this string is intentionally parsable.
+for /f "tokens=4 delims= " %%a in ('"%JAVA_EXE%" -fullversion 2^>^&1 1^>nul') do ( for /f "delims=." %%b in ('echo %%a') do set JAVA_VERSION="%%b" )
+set JAVA_VERSION=%JAVA_VERSION:"=%
+if %JAVA_VERSION% gtr 17 (
+    set DEFAULT_JVM_OPTS=%DEFAULT_JVM_OPTS% -Djava.security.manager=allow
+)
+
 @rem Execute ${applicationName}
 "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %${optsEnvironmentVar}% <% if ( appNameSystemProperty ) { %>"-D${appNameSystemProperty}=%APP_BASE_NAME%"<% } %> <% if ( mainClassName.startsWith('--module ') ) { %>--module-path "%MODULE_PATH%" <% } %>-jar lib\\Terasology.jar %*