[hibernate-issues] [Hibernate-JIRA] Updated: (HV-171) Hibernate Validator must specify how to run in environments that use a SecurityManager

Hibernate Validator must specify how to run in environments that use a SecurityManager -------------------------------------------------------------------------------------- Key: HV-171 URL: http://opensource.atlassian.com/projects/hibernate/browse/HV-171 Project: Hibernate Validator Issue Type: Improvement Components: documentation Affects Versions: 4.0.0.Beta1 Environment: Glassfish V3 with Security Manager Enabled Reporter: Ed Burns Attachments: message.txt When running the JSR-303 Impl that is Hibernate Validator 4.0.0.Beta1 on a container with a SecurityManager, such as Glassfishv3 with the SecurityManager enabled, calling simple validator code such as: Set<ConstraintViolation<Person>> violations = beanValidator.validate(person); Will cause an AccessControlException, as shown in the following stack trace: [#|2009-06-19T11:22:20.347-0400|SEVERE|glassfish|javax.enterprise.system.container.web.com.sun.enterprise.web|_ThreadID=17;_ThreadName=Thread-1;|StandardWrapperValve[SimpleBVServlet]: PWC1406: Servlet.service() for servlet SimpleBVServlet threw exception java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323) at java.security.AccessController.checkPermission(AccessController.java:546) at java.lang.SecurityManager.checkPermission(SecurityManager.java:532) at java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:107) at org.hibernate.validation.util.ReflectionHelper.setAccessibility(ReflectionHelper.java:195) at org.hibernate.validation.engine.BeanMetaDataImpl.initFieldConstraints(BeanMetaDataImpl.java:233) at org.hibernate.validation.engine.BeanMetaDataImpl.initClass(BeanMetaDataImpl.java:207) at org.hibernate.validation.engine.BeanMetaDataImpl.createMetaData(BeanMetaDataImpl.java:179) at org.hibernate.validation.engine.BeanMetaDataImpl.<init>(BeanMetaDataImpl.java:106) at org.hibernate.validation.engine.BeanMetaDataImpl.<init>(BeanMetaDataImpl.java:96) at org.hibernate.validation.engine.ValidatorImpl.getBeanMetaData(ValidatorImpl.java:559) at org.hibernate.validation.engine.ValidatorImpl.validateConstraints(ValidatorImpl.java:225) at org.hibernate.validation.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:189) at org.hibernate.validation.engine.ValidatorImpl.validate(ValidatorImpl.java:110) at simple_bv_servlet.SimpleBVServlet.doGet(SimpleBVServlet.java:76) at javax.servlet.http.HttpServlet.service(HttpServlet.java:734) at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:319) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:517) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:352) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:209) at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1499) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:293) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:187) at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:641) at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:97) at com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:85) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:185) at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:353) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:249) at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:147) at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:746) at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:655) at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:905) at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:161) at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:136) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:103) at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:89) at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76) at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53) at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57) at com.sun.grizzly.ContextTask.run(ContextTask.java:69) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) at java.lang.Thread.run(Thread.java:637) Some remedies include: 1. Explicitly accounting for SecurityManager considerations in the JSR-303 Java API 2. Mentioning in the spec prose what a caller that wishes to use SecurityManager must do to enable JSR-303 to work without throwing security related exceptions.