What happens when you place org.jboss.reflect.plugins.AnnotationValueImpl.equals(AnnotationValueImpl.java:149) under a privileged block? On 11/23/2009 01:14 PM, Ales Justin wrote: > While running MC/Kernel tests under security, I stumbled upon this. > Doesn't this indicate a JDK bug? > As all I'm doing is Annotation::equals. > > Shouldn't it make sure it runs its internal code in privileged block? > * sun.reflect.annotation.AnnotationInvocationHandler.equalsImpl > > --- > > Caused by: java.security.AccessControlException: access denied > (java.lang.RuntimePermission accessDeclaredMembers) > at > java.security.AccessControlContext.checkPermission(AccessControlContext.java:264) > > at > java.security.AccessController.checkPermission(AccessController.java:427) > at > java.lang.SecurityManager.checkPermission(SecurityManager.java:532) > at > java.lang.SecurityManager.checkMemberAccess(SecurityManager.java:1662) > at java.lang.Class.checkMemberAccess(Class.java:2125) > at java.lang.Class.getDeclaredMethods(Class.java:1762) > at > sun.reflect.annotation.AnnotationInvocationHandler.getMemberMethods(AnnotationInvocationHandler.java:257) > > at > sun.reflect.annotation.AnnotationInvocationHandler.equalsImpl(AnnotationInvocationHandler.java:169) > > at > sun.reflect.annotation.AnnotationInvocationHandler.invoke(AnnotationInvocationHandler.java:40) > > at $Proxy22.equals(Unknown Source) > at > org.jboss.reflect.plugins.AnnotationValueImpl.equals(AnnotationValueImpl.java:149) > > at java.util.HashMap.put(HashMap.java:422) > at java.util.HashSet.add(HashSet.java:194) > at > org.jboss.beans.info.plugins.AbstractBeanInfoFactory.mergeAnnotations(AbstractBeanInfoFactory.java:352) > > at > org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanProperties(AbstractBeanInfoFactory.java:311) > > at > org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanInfo(AbstractBeanInfoFactory.java:157) > > at > org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanInfo(AbstractBeanInfoFactory.java:124) > > at > org.jboss.config.plugins.AbstractConfiguration.getBeanInfo(AbstractConfiguration.java:81) > > at > org.jboss.xb.builder.JBossXBNoSchemaBuilder.generateType(JBossXBNoSchemaBuilder.java:894) > > > --- AnnotationValueImpl > > @Override > public boolean equals(Object o) > { > if (this == o) return true; > if (o == null || !(o instanceof AnnotationValue)) return false; > > final AnnotationValue annotationValue = (AnnotationValue) o; > > if (!annotationType.equals(annotationValue.getAnnotationType())) > return false; > if (!attributeValues.equals(annotationValue.getValues())) return > false; > > Annotation otherUnderlying = > annotationValue.getUnderlyingAnnotation(); > if (underlying == null&& otherUnderlying != null) > return false; > if (underlying != null&& otherUnderlying == null) > return false; > return underlying.equals(otherUnderlying); > }

Yeah, that makes it go away, but that's not the fix, it's a workaround. :-) Anil Saldhana wrote: > Add a priv block to line 149 of the Impl class. Tell us what the > behavior is. I think that is what is missing. > > On 11/23/2009 01:43 PM, Anil Saldhana wrote: > >> What happens when you place >> >> org.jboss.reflect.plugins.AnnotationValueImpl.equals(AnnotationValueImpl.java:149) >> >> >> under a privileged block? >> >> On 11/23/2009 01:14 PM, Ales Justin wrote: >> >> >>> While running MC/Kernel tests under security, I stumbled upon this. >>> Doesn't this indicate a JDK bug? >>> As all I'm doing is Annotation::equals. >>> >>> Shouldn't it make sure it runs its internal code in privileged block? >>> * sun.reflect.annotation.AnnotationInvocationHandler.equalsImpl >>> >>> --- >>> >>> Caused by: java.security.AccessControlException: access denied >>> (java.lang.RuntimePermission accessDeclaredMembers) >>> at >>> java.security.AccessControlContext.checkPermission(AccessControlContext.java:264) >>> >>> at >>> java.security.AccessController.checkPermission(AccessController.java:427) >>> at >>> java.lang.SecurityManager.checkPermission(SecurityManager.java:532) >>> at >>> java.lang.SecurityManager.checkMemberAccess(SecurityManager.java:1662) >>> at java.lang.Class.checkMemberAccess(Class.java:2125) >>> at java.lang.Class.getDeclaredMethods(Class.java:1762) >>> at >>> sun.reflect.annotation.AnnotationInvocationHandler.getMemberMethods(AnnotationInvocationHandler.java:257) >>> >>> at >>> sun.reflect.annotation.AnnotationInvocationHandler.equalsImpl(AnnotationInvocationHandler.java:169) >>> >>> at >>> sun.reflect.annotation.AnnotationInvocationHandler.invoke(AnnotationInvocationHandler.java:40) >>> >>> at $Proxy22.equals(Unknown Source) >>> at >>> org.jboss.reflect.plugins.AnnotationValueImpl.equals(AnnotationValueImpl.java:149) >>> >>> at java.util.HashMap.put(HashMap.java:422) >>> at java.util.HashSet.add(HashSet.java:194) >>> at >>> org.jboss.beans.info.plugins.AbstractBeanInfoFactory.mergeAnnotations(AbstractBeanInfoFactory.java:352) >>> >>> at >>> org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanProperties(AbstractBeanInfoFactory.java:311) >>> >>> at >>> org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanInfo(AbstractBeanInfoFactory.java:157) >>> >>> at >>> org.jboss.beans.info.plugins.AbstractBeanInfoFactory.getBeanInfo(AbstractBeanInfoFactory.java:124) >>> >>> at >>> org.jboss.config.plugins.AbstractConfiguration.getBeanInfo(AbstractConfiguration.java:81) >>> >>> at >>> org.jboss.xb.builder.JBossXBNoSchemaBuilder.generateType(JBossXBNoSchemaBuilder.java:894) >>> >>> >>> --- AnnotationValueImpl >>> >>> @Override >>> public boolean equals(Object o) >>> { >>> if (this == o) return true; >>> if (o == null || !(o instanceof AnnotationValue)) return false; >>> >>> final AnnotationValue annotationValue = (AnnotationValue) o; >>> >>> if (!annotationType.equals(annotationValue.getAnnotationType())) >>> return false; >>> if (!attributeValues.equals(annotationValue.getValues())) return >>> false; >>> >>> Annotation otherUnderlying = >>> annotationValue.getUnderlyingAnnotation(); >>> if (underlying == null&& otherUnderlying != null) >>> return false; >>> if (underlying != null&& otherUnderlying == null) >>> return false; >>> return underlying.equals(otherUnderlying); >>> }

Yeah, confirmed bug: * http://mail.openjdk.java.net/pipermail/security-dev/2008-October/000356.html * http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4140596 (remembered I've seen this before :-) Anil Saldhana wrote: > I agree that it is a JDK bug. >

It's not like it never happens to us :) On 23 nov. 09, at 23:18, Anil Saldhana wrote: > In 12+ months, no attempt was made to fix the bug? > > On 11/23/2009 03:54 PM, Ales Justin wrote: > >> Yeah, confirmed bug: >> * >> http://mail.openjdk.java.net/pipermail/security-dev/2008-October/000356.html >> * http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4140596 >> (remembered I've seen this before :-) >> >> Anil Saldhana wrote: >> >> >>> I agree that it is a JDK bug. >>> >>>