<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
Testing jboss-reflect with a SecurityManager enabled
</h3>
<span style="margin-bottom: 10px;">
created by <a href="http://community.jboss.org/people/kabir.khan%40jboss.com">Kabir Khan</a> in <i>JBoss Microcontainer Development</i> - <a href="http://community.jboss.org/message/534031#534031">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><div id="_mcePaste">I am enabling security for jboss-reflect and going through and adding privileged blocks where needed. Currently I am using this test policy plugin </div><div> </div><div id="_mcePaste"> </div><div id="_mcePaste"> </div><pre class="jive-pre"><code class="jive-code jive-java"><font color="navy"><b>public</b></font> <font color="navy"><b>class</b></font> ContainerTestPolicyPlugin <font color="navy"><b>extends</b></font> TestsPolicyPlugin
<font color="navy">{</font>
   <font color="navy"><b>public</b></font> ContainerTestPolicyPlugin(Class<?> clazz)
   <font color="navy">{</font>
      <font color="navy"><b>super</b></font>(clazz);
   <font color="navy">}</font>
   <font color="navy"><b>public</b></font> PermissionCollection getPermissions(CodeSource codesource)
   <font color="navy">{</font>
      PermissionCollection collection = super.getPermissions(codesource);
      collection.add(<font color="navy"><b>new</b></font> RuntimePermission(<font color="red">"accessDeclaredMembers"</font>));
      collection.add(<font color="navy"><b>new</b></font> RuntimePermission(<font color="red">"getClassloader"</font>));
      collection.add(<font color="navy"><b>new</b></font> RuntimePermission(<font color="red">"accessClassInPackage.sun.reflect"</font>));
      <font color="navy"><b>return</b></font> collection;
   <font color="navy">}</font>
<font color="navy">}</font>
</code></pre><div id="_mcePaste"> </div><div id="_mcePaste">Once I'm done I'll see about adding property files for individual tests, or I might just leave this in?</div><div> </div><div id="_mcePaste"> </div><div id="_mcePaste">Anyway, the problem I am having is for the following tests:</div><div id="_mcePaste"><ul><li>BeanInfoUtilTestCase - which seems to assume that it will ALWAYS be able to set/get  fields whether they are public or private.</li><li>Field-/MethodAccessRestrictionTestCase - which seems to assume that it can set/get private fields when there is no security manager, but not when there is one.</li></ul></div><div id="_mcePaste"> </div><div id="_mcePaste">From what I can work out BeanInfoUtilTestCase was not written with a security manager enabled, so I will modify BeanInfoUtilTestCase to override the delegate so it will never use a security manager no matter what ContainerTest.getDelegate() does.</div><div> </div><div id="_mcePaste"> </div><div id="_mcePaste">The next problem is the Javassist version of the Field-/MethodAccessRestrictionTestCase. These fail since the javassist generated accessors (from JBREFLECT-6) are able to access private members, due to inheriting from sun.reflect.MagicAccessorImpl, so we don't get the expected exceptions when calling private members with a security manager enabled. My plan there is to modify JavassistFieldInfo and JavassistMethodInfo to throw an exception if an attempt is made to access them if they are not public and there is a security manager present.</div></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="http://community.jboss.org/message/534031#534031">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in JBoss Microcontainer Development at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2115">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>