[JBoss Microcontainer Development] New message: "Re: Security problems with org.jboss.test:jboss-test 1.1.5.GA"
by Flavia Rainone
JBoss development,
A new message was posted in the thread "Security problems with org.jboss.test:jboss-test 1.1.5.GA":
http://community.jboss.org/message/530617#530617
Author : Flavia Rainone
Profile : http://community.jboss.org/people/flavia.rainone@jboss.com
Message:
--------------------------------------------------------------
> mailto:adrian@jboss.org wrote:
>
> Looks like a bug to me, but I don't see any recent changes in the code that would cause the problem?
>
> The SecurityManager shouldn't be installed until it runs AbstractTestDelegate.setUp()
> The error above is happening in the constructor of the delegate.
>
> Its only after that happens that you can do:
>
> delegate.enableSecurity = true;
>
> Most likely, there is a security manager still around from a previous test?
You're right!
Taking a better look, I found this:
public class AOPTestDelegate extends AbstractTestDelegate
{
public void tearDown() throws Exception
{
>>> //TODO Figure out cause of security exception when making this call
>>> // super.tearDown();
String deployedByClassLoader = (String)systemProps.get(EclipseTestTransformer.CLASSLOADER_DEPLOYED_XML);
if (deployedByClassLoader != null)
{
URL url = Thread.currentThread().getContextClassLoader().getResource(deployedByClassLoader);
AspectXmlLoader.undeployXML(url);
}
}
}
AbstractTestDelegate.setUpSecurity defines a SecurityManager, and AbstractTestDelegate.tearDownSecurity should set the SecurityManager as null. This is not happening, because AbstractTestDelegate.tearDown is overwritten and the call to super.tearDown is commented out.
Uncomenting this call took me to:
Testcase: testBasic took 1.531 sec
Caused an ERROR
access denied (java.lang.RuntimePermission setSecurityManager)
java.security.AccessControlException: access denied (java.lang.RuntimePermission setSecurityManager)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.System.setSecurityManager0(System.java:272)
at java.lang.System.setSecurityManager(System.java:263)
at org.jboss.test.AbstractTestDelegate.tearDownSecurity(AbstractTestDelegate.java:195)
at org.jboss.test.AbstractTestDelegate.tearDown(AbstractTestDelegate.java:142)
at org.jboss.test.aop.AOPTestDelegate.tearDown(AOPTestDelegate.java:66)
at org.jboss.test.AbstractTestSetup.tearDown(AbstractTestSetup.java:73)
at org.jboss.test.AbstractTestCaseWithSetup.tearDown(AbstractTestCaseWithSetup.java:112)
>From that, I'm assuming that I should define a security policy that allow AbstractTestDelegate to call setSecurityManager. Is that correct?
--------------------------------------------------------------
To reply to this message visit the message page: http://community.jboss.org/message/530617#530617
16 years
[JBoss Microcontainer Development] New message: "ClassLoader ease-of-use again"
by Adrian Brock
JBoss development,
A new message was posted in the thread "ClassLoader ease-of-use again":
http://community.jboss.org/message/530571#530571
Author : Adrian Brock
Profile : http://community.jboss.org/people/adrian@jboss.org
Message:
--------------------------------------------------------------
There were a couple of tests in deployers-vfs that were using the export-all flag wrongly.
They had something like:
<classloading xmlns="urn:jboss:classloading:1.0" export-all="NON_EMPTY">
<capabilities>
<module name="test3"/>
</capabilities>
</classloading>
Since the capabilities have been explicitly declared, the export-all should have been ignored,
but apparently it was not.
This was actually due to the Module asking the ClassLoaderPolicy for its exported()
delegate which does know about the capabilities filtering.
I've just changed this code so that it correctly uses the Module.determinePackages()
to decide what should be in the exported classes filter.
Accordingly, I had to fix the tests to declare they had the package capability:
<classloading xmlns="urn:jboss:classloading:1.0">
<capabilities>
<module name="test3"/>
<package name="a.b.c"/>
</capabilities>
</classloading>
When I first did this, I suggested that we might be able to support
the export-all flag even if capabilities are specified, e.g. if there
are no explicit packages then we use the export-all rule.
But if we are going to support it, it should be done properly, not
leaking in because of a bug. ;-)
--------------------------------------------------------------
To reply to this message visit the message page: http://community.jboss.org/message/530571#530571
16 years, 1 month