March 2008 - jboss-dev-forums - Jboss List Archives

[Design the new POJO MicroContainer] - Re: Field injection

by alesj

"adrian(a)jboss.org" wrote : In case its not clear Nope, not clear. :-) OK, I'm glad I didn't introduce security hole :-), but I don't see why your example will fail with the current code? And you're saying this field.setAcceessible should be in privileged block? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137049#4137049 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137049

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field injection

by alesj

"adrian(a)jboss.org" wrote : Also I don't see a test in the kernel project that is validating | that you can't use the xml deployment (or programmatic deployment) | to bypass the private field access. | Not yet there. ;-) Wanted to clear the Signature issue before hacking all the tests. Will add that to the list of tests. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137048#4137048 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137048

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field injection

by adrian＠jboss.org

"adrian(a)jboss.org" wrote : "adrian(a)jboss.org" wrote : | | public void setField(Field field) | | { | | this.field = field; | | if (isPublic() == false && field != null) | | field.setAccessible(true); | | } | | | | Actually its not a security hole, because you have done it properly. | The setAccessible will fail depending upon the who the caller is. | In case its not clear, I'm saying it should be in a privileged block these objects get cached and shared across threads. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137047#4137047 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137047

18 years

1
0
0 / 0

[Design of JBossXB] - Re: JBossEntityResolver and xsd:redefine resolution

by alex.loubyansky＠jboss.com

The issue for this http://jira.jboss.com/jira/browse/JBCOMMON-43 I've committed the fix and the the testcase to common-core org.jboss.test.util.test.xml.resolver.JBossEntityResolverUnitTestCase. Possible backwards incompatibility in behavior is that schema location registered locally is different from the one in the XML's schemaLocation with the purpose of override. In this case, the schemaLocation from the XML file will be used. And at the moment w/o falling back to the registered one if the one in the XML occured to be invalid. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137046#4137046 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137046

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field injection

by adrian＠jboss.org

"adrian(a)jboss.org" wrote : | public void setField(Field field) | { | this.field = field; | if (isPublic() == false && field != null) | field.setAccessible(true); | } | Actually its not a security hole, because you have done it properly. The setAccessible will fail depending upon the who the caller is. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137045#4137045 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137045

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field injection

by adrian＠jboss.org

Also I don't see a test in the kernel project that is validating that you can't use the xml deployment (or programmatic deployment) to bypass the private field access. e.g. See the AccessControlContextTestCase that validates that somebody can't use the MC to get access the system properties if they don't have the right to do so. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137044#4137044 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137044

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field injection

by adrian＠jboss.org

This is a security hole: | /** | * Set the field | * | * @param field the field | */ | public void setField(Field field) | { | this.field = field; | if (isPublic() == false && field != null) | field.setAccessible(true); | } | | /** | * Get the field | * | * @return the field | */ | public Field getField() | { | return field; | } | = | e.g. | java.lang.reflect.Field field = ...; // I can't do setAccesible | ReflectFieldInfoImpl impl = new ReflectionFieldInfoImpl(); | impl.setField(); // So I'll use this hole | field = impl.getField(); // This should have an access check | View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137042#4137042 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137042

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field signature usage

by alesj

"alesj" wrote : "adrian(a)jboss.org" wrote : | | Why? What are you talking about? | | BeanInfo/Reflection is not based on the metadata repository. It is the other way around. | | | Sure. | But have a look at AbstractBeanAnnotationAdapter. | It needs Signature to get the MetaData. | | "adrian(a)jboss.org" wrote : | | If you've done the field properties correctly, then this should just be | | a case of using propertyInfo.get(Underlying)Annotations() | | i.e. no getters/setters means use the field to get the annotations, but this | | is all hidden from the caller - they are "property annotations" | | | That's all done. ;-) OK, PI.getFieldInfo solves the problem. I'll remove the fields check in AbstractBeanAnnotationAdapter, since they are already included in the propertys if the beaninfo has the right mode. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137041#4137041 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137041

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: KernelScopeInfo and property annotations

by alesj

"adrian(a)jboss.org" wrote : You should just add a "getFieldInfo" to the PropertyInfo. | It's then just another "if" statement. | | This code is ugly anyway, it is this way because aop has no notion of "property" | instead the annotations must be stored against the "joinpoint", i.e. getters/setters | and now fields. Plain ugly, but effective. :-) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137040#4137040 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137040

18 years

1
0
0 / 0

[Design the new POJO MicroContainer] - Re: Field signature usage

by alesj

"adrian(a)jboss.org" wrote : | Why? What are you talking about? | BeanInfo/Reflection is not based on the metadata repository. It is the other way around. | Sure. But have a look at AbstractBeanAnnotationAdapter. It needs Signature to get the MetaData. "adrian(a)jboss.org" wrote : | If you've done the field properties correctly, then this should just be | a case of using propertyInfo.get(Underlying)Annotations() | i.e. no getters/setters means use the field to get the annotations, but this | is all hidden from the caller - they are "property annotations" | That's all done. ;-) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137039#4137039 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4137039

18 years

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-dev-forums March 2008