Author: epbernard Date: 2009-08-11 15:33:12 -0400 (Tue, 11 Aug 2009) New Revision: 17266 Modified: beanvalidation/trunk/validation-api/src/main/java/javax/validation/Validation.java beanvalidation/trunk/validation-tck/pom.xml beanvalidation/trunk/validation-tck/src/main/java/org/hibernate/jsr303/tck/tests/constraints/groups/inheritance/GroupInheritanceTest.java validator/trunk/pom.xml Log: HV-171 implement security in Validation Modified: beanvalidation/trunk/validation-api/src/main/java/javax/validation/Validation.java =================================================================== --- beanvalidation/trunk/validation-api/src/main/java/javax/validation/Validation.java 2009-08-11 19:31:41 UTC (rev 17265) +++ beanvalidation/trunk/validation-api/src/main/java/javax/validation/Validation.java 2009-08-11 19:33:12 UTC (rev 17266) @@ -27,6 +27,8 @@ import java.io.BufferedReader; import java.io.InputStreamReader; import java.io.IOException; +import java.security.PrivilegedAction; +import java.security.AccessController; import javax.validation.bootstrap.GenericBootstrap; import javax.validation.bootstrap.ProviderSpecificBootstrap; import javax.validation.spi.BootstrapState; @@ -265,15 +267,16 @@ //cache per classloader for an appropriate discovery //keep them in a weak hashmap to avoid memory leaks and allow proper hot redeployment //TODO use a WeakConcurrentHashMap + //FIXME The List<VP> does keep a strong reference to the key ClassLoader, use the same model as JPA CachingPersistenceProviderResolver private static final Map<ClassLoader, List<ValidationProvider<?>>> providersPerClassloader = new WeakHashMap<ClassLoader, List<ValidationProvider<?>>>(); private static final String SERVICES_FILE = "META-INF/services/" + ValidationProvider.class.getName(); public List<ValidationProvider<?>> getValidationProviders() { - ClassLoader classloader = Thread.currentThread().getContextClassLoader(); + ClassLoader classloader = GetClassLoader.fromContext(); if ( classloader == null ) { - classloader = DefaultValidationProviderResolver.class.getClassLoader(); + classloader = GetClassLoader.fromClass( DefaultValidationProviderResolver.class ); } List<ValidationProvider<?>> providers; @@ -334,10 +337,10 @@ return providers; } - private static Class<?> loadClass(String name, Class caller) throws ClassNotFoundException { + private static Class<?> loadClass(String name, Class<?> caller) throws ClassNotFoundException { try { //try context classloader, if fails try caller classloader - ClassLoader loader = Thread.currentThread().getContextClassLoader(); + ClassLoader loader = GetClassLoader.fromContext(); if ( loader != null ) { return loader.loadClass( name ); } @@ -348,7 +351,45 @@ throw e; } } - return Class.forName( name, true, caller.getClassLoader() ); + return Class.forName( name, true, GetClassLoader.fromClass( caller ) ); } } + + private static class GetClassLoader implements PrivilegedAction<ClassLoader> { + private final Class<?> clazz; + + public static ClassLoader fromContext() { + final GetClassLoader action = new GetClassLoader( null ); + if (System.getSecurityManager() != null) { + return AccessController.doPrivileged( action ); + } + else { + return action.run(); + } + } + + public static ClassLoader fromClass(Class<?> clazz) { + if ( clazz == null ) throw new IllegalArgumentException("Class is null"); + final GetClassLoader action = new GetClassLoader( clazz ); + if (System.getSecurityManager() != null) { + return AccessController.doPrivileged( action ); + } + else { + return action.run(); + } + } + + private GetClassLoader(Class<?> clazz) { + this.clazz = clazz; + } + + public ClassLoader run() { + if (clazz != null) { + return clazz.getClassLoader(); + } + else { + return Thread.currentThread().getContextClassLoader(); + } + } + } } Modified: beanvalidation/trunk/validation-tck/pom.xml =================================================================== --- beanvalidation/trunk/validation-tck/pom.xml 2009-08-11 19:31:41 UTC (rev 17265) +++ beanvalidation/trunk/validation-tck/pom.xml 2009-08-11 19:33:12 UTC (rev 17266) @@ -46,7 +46,7 @@ <dependency> <groupId>javax.validation</groupId> <artifactId>validation-api</artifactId> - <version>1.0.CR3</version> + <version>1.0.CR4-SNAPSHOT</version> </dependency> <dependency> <groupId>org.jboss.test-audit</groupId> Modified: beanvalidation/trunk/validation-tck/src/main/java/org/hibernate/jsr303/tck/tests/constraints/groups/inheritance/GroupInheritanceTest.java =================================================================== --- beanvalidation/trunk/validation-tck/src/main/java/org/hibernate/jsr303/tck/tests/constraints/groups/inheritance/GroupInheritanceTest.java 2009-08-11 19:31:41 UTC (rev 17265) +++ beanvalidation/trunk/validation-tck/src/main/java/org/hibernate/jsr303/tck/tests/constraints/groups/inheritance/GroupInheritanceTest.java 2009-08-11 19:33:12 UTC (rev 17266) @@ -71,7 +71,7 @@ // PreManufacturing belongs implicitly to All PropertyDescriptor propertyDescriptor = descriptor.getConstraintsForProperty( "partNumber" ); - Set<ConstraintDescriptor<?>> descriptorsForGroup = propertyDescriptor.getUnorderdConstraintDescriptorsMatchingGroups( + Set<ConstraintDescriptor<?>> descriptorsForGroup = propertyDescriptor.getUnorderedConstraintDescriptorsMatchingGroups( All.class ); assertEquals( descriptorsForGroup.size(), 1, "Wrong number of descriptors" ); @@ -79,12 +79,12 @@ // PostManufacturing belongs implicitly to All propertyDescriptor = descriptor.getConstraintsForProperty( "qaChecked" ); - descriptorsForGroup = propertyDescriptor.getUnorderdConstraintDescriptorsMatchingGroups( All.class ); + descriptorsForGroup = propertyDescriptor.getUnorderedConstraintDescriptorsMatchingGroups( All.class ); assertEquals( descriptorsForGroup.size(), 1, "Wrong number of descriptors" ); assertEquals( descriptorsForGroup.iterator().next().getAnnotation().annotationType(), AssertTrue.class ); propertyDescriptor = descriptor.getConstraintsForProperty( "size" ); - descriptorsForGroup = propertyDescriptor.getUnorderdConstraintDescriptorsMatchingGroups( All.class ); + descriptorsForGroup = propertyDescriptor.getUnorderedConstraintDescriptorsMatchingGroups( All.class ); assertEquals( descriptorsForGroup.size(), 1, "Wrong number of descriptors" ); assertEquals( descriptorsForGroup.iterator().next().getAnnotation().annotationType(), Max.class ); } Modified: validator/trunk/pom.xml =================================================================== --- validator/trunk/pom.xml 2009-08-11 19:31:41 UTC (rev 17265) +++ validator/trunk/pom.xml 2009-08-11 19:33:12 UTC (rev 17266) @@ -47,7 +47,7 @@ <dependency> <groupId>javax.validation</groupId> <artifactId>validation-api</artifactId> - <version>1.0.CR3</version> + <version>1.0.CR4-SNAPSHOT</version> </dependency> <dependency> <groupId>org.slf4j</groupId>