[
https://issues.jboss.org/browse/WFLY-5771?page=com.atlassian.jira.plugin....
]
Ivo Studensky commented on WFLY-5771:
-------------------------------------
stacktrace:
{noformat}
at
org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:271)
at
org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:175)
at org.omg.CORBA_2_3.portable.InputStream.checkPermission(InputStream.java:67)
at org.omg.CORBA_2_3.portable.InputStream.<init>(InputStream.java:84)
at com.sun.corba.se.impl.encoding.CDRInputStream.<init>(CDRInputStream.java:116)
at
com.sun.corba.se.impl.encoding.EncapsInputStream.<init>(EncapsInputStream.java:66)
at
com.sun.corba.se.impl.encoding.EncapsInputStream.<init>(EncapsInputStream.java:120)
at
com.sun.corba.se.impl.encoding.EncapsInputStream.<init>(EncapsInputStream.java:98)
at
org.wildfly.iiop.openjdk.csiv2.CSIV2IORToSocketInfo.readCompoundSecMechList(CSIV2IORToSocketInfo.java:146)
at
org.wildfly.iiop.openjdk.csiv2.CSIV2IORToSocketInfo.selectSSLTransportAddress(CSIV2IORToSocketInfo.java:117)
at
org.wildfly.iiop.openjdk.csiv2.CSIV2IORToSocketInfo.getSocketInfo(CSIV2IORToSocketInfo.java:99)
at
com.sun.corba.se.impl.transport.CorbaContactInfoListImpl.addRemoteContactInfos(CorbaContactInfoListImpl.java:189)
at
com.sun.corba.se.impl.transport.CorbaContactInfoListImpl.createContactInfoList(CorbaContactInfoListImpl.java:178)
at
com.sun.corba.se.impl.transport.CorbaContactInfoListImpl.iterator(CorbaContactInfoListImpl.java:80)
- locked <0x359a> (a com.sun.corba.se.impl.transport.CorbaContactInfoListImpl)
at
com.sun.corba.se.impl.protocol.CorbaClientDelegateImpl.request(CorbaClientDelegateImpl.java:122)
at org.omg.CORBA.portable.ObjectImpl._request(ObjectImpl.java:449)
at org.jboss.as.ejb3.iiop.stub.DynamicIIOPStub.invoke(DynamicIIOPStub.java:123)
at interface
org.jboss.as.test.iiop.transaction.IIOPTransactionalStatefulRemote_Stub.sameTransaction(Unknown
Source:-1)
at org.jboss.as.test.iiop.transaction.ClientEjb.testSynchronization(ClientEjb.java:61)
{noformat}
IIOP operations need
SerializablePermission("enableSubclassImplementation")
---------------------------------------------------------------------------
Key: WFLY-5771
URL:
https://issues.jboss.org/browse/WFLY-5771
Project: WildFly
Issue Type: Bug
Components: IIOP, Transactions
Affects Versions: 10.0.0.CR4
Reporter: Ivo Studensky
Assignee: Ivo Studensky
Since JDK 7u25 version {{org.omg.CORBA_2_3.portable.Output/InputStream}} classes need
extra permissions if Security Manager is enabled. Because of a previous vulnerability, it
now checks {{SerializablePermission("enableSubclassImplementation")}}. There is
a property flag to allow subclass instantiations without the security check
(jdk.corba.allowOutputStreamSubclass=true), but this system property is subject to removal
in the future Java releases, according to my findings.
At the moment, our IIOP code fails (can be seen in iiop tests of WildFly testsuite) when
running with SM enabled.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)