[JBoss JIRA] Created: (JBRULES-760) Security problem in WebSphere with PackageCompilationData classloader
by Carey Evans (JIRA)
Security problem in WebSphere with PackageCompilationData classloader
---------------------------------------------------------------------
Key: JBRULES-760
URL: http://jira.jboss.com/jira/browse/JBRULES-760
Project: JBoss Rules
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Reteoo
Affects Versions: 3.0.6
Environment: WebSphere Application Server 6.0.2.17 Express with IBM JDK 1.4.2 SR5 on Windows Server 2003
Reporter: Carey Evans
Assigned To: Mark Proctor
This problem is very similar to JBRULES-562, but affects classes loaded by org.drools.rule.PackageCompilationData.PackageClassLoader rather than org.drools.base.ClassFieldExtractorFactory. The symptoms are the same:
[29/03/07 16:18:44:279 NZST] 00000034 SecurityManag W SECJ0314W: Current Java 2 Security policy reported a potential violation of Java 2 Security Permission. Please refer to Problem Determination Guide for further information.
Permission:
accessDeclaredMembers : access denied (java.lang.RuntimePermission accessDeclaredMembers)
Code:
BrowseCatalog.Rule_Bad_Rule_0 in {null code URL}
Stack Trace:
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessDeclaredMembers)
[...]
at java.lang.Class.getDeclaredConstructor(Class.java(Compiled Code))
at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:60)
[...]
at com.elasticpath.domain.rules.impl.PromotionRuleDelegateImpl.isFirstTimeBuyer(PromotionRuleDelegateImpl.java:975)
at BrowseCatalog.Rule_Bad_Rule_0.eval1(Rule_Bad_Rule_0.java:16)
at BrowseCatalog.Rule_Bad_Rule_0Eval1Invoker.evaluate(Rule_Bad_Rule_0Eval1Invoker.java:20)
at org.drools.rule.EvalCondition.isAllowed(Unknown Source)
[...]
Code Base Location:
[...]
BrowseCatalog.Rule_Bad_Rule_0 : null code URL
ClassLoader: org.drools.rule.PackageCompilationData$PackageClassLoader
Permissions granted to CodeSource (null <no certificates>)
{
}
BrowseCatalog.Rule_Bad_Rule_0Eval1Invoker : null code URL
ClassLoader: org.drools.rule.PackageCompilationData$PackageClassLoader
Permissions granted to CodeSource (null <no certificates>)
{
}
I've made the same change to PackageCompilationData as was made to ClassFieldExtractorFactory, which has fixed the problem:
--- drools-core/src/main/java/org/drools/rule/PackageCompilationData.java (revision 10605)
+++ drools-core/src/main/java/org/drools/rule/PackageCompilationData.java (working copy)
@@ -24,6 +24,9 @@
import java.io.ObjectInput;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.ProtectionDomain;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
@@ -47,6 +50,16 @@
*/
private static final long serialVersionUID = -4351259299237235523L;
+ private static final ProtectionDomain PROTECTION_DOMAIN;
+
+ static {
+ PROTECTION_DOMAIN = (ProtectionDomain) AccessController.doPrivileged( new PrivilegedAction() {
+ public Object run() {
+ return PackageCompilationData.class.getProtectionDomain();
+ }
+ } );
+ }
+
private Map invokerLookups = new HashMap();
private Object AST;
@@ -280,7 +293,8 @@
return defineClass( name,
clazzBytes,
0,
- clazzBytes.length );
+ clazzBytes.length,
+ PROTECTION_DOMAIN );
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months
[JBoss JIRA] Created: (JBRULES-446) Support rulebase configuration via jsr94 registerRuleExecutionSet properties
by Juergen none (JIRA)
Support rulebase configuration via jsr94 registerRuleExecutionSet properties
----------------------------------------------------------------------------
Key: JBRULES-446
URL: http://jira.jboss.com/jira/browse/JBRULES-446
Project: JBoss Rules
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: JSR94
Affects Versions: 3.0.4
Reporter: Juergen none
Assigned To: Mark Proctor
Priority: Minor
Is it possible to support rulebase configuration via jsr94 registerRuleExecutionSet properties?
Suggestion:
- new property in
org.drools.jsr94.rules.Constants.java:41:
//jh: added to support handing a rulebase config via jsr94
/** <code>RuleExecutionSet</code> rulebase config constant. */
public static final String RES_CONFIG = "javax.rules.admin.RuleExecutionSet.config";
- modification of method (probably secure against ClassCastException)
org.drools.jsr94.rules.admin.RuleExecutionSetImpl.java:118:RuleExecutionSetImpl(...):
//jh: support rulebase configuration via jsr94
final org.drools.reteoo.ReteooRuleBase ruleBase = new org.drools.reteoo.ReteooRuleBase((org.drools.RuleBaseConfiguration)properties.get(org.drools.jsr94.rules.Constants.RES_CONFIG), new Jsr94FactHandleFactory() );
/*
final org.drools.reteoo.ReteooRuleBase ruleBase = new org.drools.reteoo.ReteooRuleBase( new Jsr94FactHandleFactory() );
*/
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months
[JBoss JIRA] Created: (JBRULES-528) Implementation for Decision tables, and compiler options in DroolsJSR
by Vignesh S (JIRA)
Implementation for Decision tables, and compiler options in DroolsJSR
---------------------------------------------------------------------
Key: JBRULES-528
URL: http://jira.jboss.com/jira/browse/JBRULES-528
Project: JBoss Rules
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: JSR94
Reporter: Vignesh S
Assigned To: Mark Proctor
Priority: Optional
The implementation for Decision tables and compiler options can be given in drools JSR and to my knowledge it can done easily in the method
public RuleExecutionSet createRuleExecutionSet(final Reader ruleExecutionSetReader,
final Map properties) throws RuleExecutionSetCreateException
org.drools.jsr94.rules.admin.LocalRuleExecutionSetProviderImpl class
By adding one more condition for ".xsl" for decision tables
and setting a new property for the compiler in map parameter
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months
[JBoss JIRA] Created: (JBPORTAL-1126) CMS needs to store contributing version for new versions of pages
by Alex Pinkin (JIRA)
CMS needs to store contributing version for new versions of pages
-----------------------------------------------------------------
Key: JBPORTAL-1126
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1126
Project: JBoss Portal
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: Portal CMS
Affects Versions: 2.4 Final
Reporter: Alex Pinkin
Assigned To: Roy Russo
-CMS needs to store contributing version for new versions of pages (1.1 was created from 1.0, etc).
To prevent locking the edit of a content item, it is useful to allow multiple drafts to be created of a content item. This situation can cause problems for approvers if there are multiple drafts needing approval. It would be helpful if approvers could see what version was the contributing version for a particular content item version.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months
[JBoss JIRA] Created: (JBRULES-573) EqualityAssertMapComparator does not work with JSR94 Fact Handles
by Juergen none (JIRA)
EqualityAssertMapComparator does not work with JSR94 Fact Handles
-----------------------------------------------------------------
Key: JBRULES-573
URL: http://jira.jboss.com/jira/browse/JBRULES-573
Project: JBoss Rules
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Affects Versions: 3.0.5
Environment: java 1.5.0_09
Reporter: Juergen none
Assigned To: Mark Proctor
Equal objects are asserted multiple times via jsr94 interface
Using jsr94 interface to use drools stateful rule session
Assert behaviour set to equality:
PROPERTY_ASSERT_BEHAVIOR = RuleBaseConfiguration.WM_BEHAVIOR_EQUALITY
fact handle factory creates org.drools.jsr94.rules.Jsr94FactHandle objects
BUT:
org.drools.common.EqualityAssertMapComparator::hashCodeOf()
obj.getClass() == this.factHandleClass is false because
this.factHandleClass is DefaultFactHandle and
obj.getClass() is Jsr94FactHandle
--> so instead of hashcode of object wrapped by handle, hashcode of facthandle object is used --> equal objects are asserted multiple times
GUESS: either
- obj.getClass() instanceof this.factHandleClass or
- this.factHandleClass should be set to Jsr94FactHandle?
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months
[JBoss JIRA] Created: (JBRULES-570) Problem compiling package from xml
by Javier Prieto (JIRA)
Problem compiling package from xml
----------------------------------
Key: JBRULES-570
URL: http://jira.jboss.com/jira/browse/JBRULES-570
Project: JBoss Rules
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: xml
Affects Versions: 3.0.4
Environment: Windows XP, Eclipse 3.2, JBoss Rules IDE 3.0.4
Reporter: Javier Prieto
Assigned To: Mark Proctor
There is a problem compiling package from an xml rule file with rules calling functions in the rhs body. This is an example of an xml rule file that fails:
<?xml version="1.0" encoding="UTF-8"?>
<package name="com.sample"
xmlns="http://drools.org/drools-3.0"
xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
xs:schemaLocation="http://drools.org/drools-3.0 drools-3.0.xsd">
<function return-type="void" name="manageAlert">
<parameter identifier="alert" type="String"/>
<body>System.out.println(alert);</body>
</function>
<function return-type="void" name="manageRuleFired">
<parameter identifier="ruleName" type="String"/>
<body>System.out.println(ruleName + " fired");</body>
</function>
<rule name="Impossible Rule">
<lhs>
<eval>1 == 2</eval>
</lhs>
<rhs>manageAlert("impossibleRule!!!"); manageRuleFired("Impossible Rule");</rhs>
</rule>
</package>
I've found a workaround. If you insert a blank char anywhere in the first sentence of the rhs body (manageAlert(...);), it works well:
<rhs>manageAlert ("impossibleRule!!!"); manageRuleFired("Impossible Rule");</rhs> (blank after manageAlert)
or, <rhs>manageAlert( "impossibleRule!!!"); manageRuleFired("Impossible Rule");</rhs> (blank after '(' )
or, <rhs> manageAlert("impossibleRule!!!"); manageRuleFired("Impossible Rule");</rhs> (blank at the begining)
or, <rhs>manageAlert("impossible Rule!!!"); manageRuleFired("Impossible Rule");</rhs> (blank in the string)
...
If you call a Java method just before or after 'manageAlert("impossible Rule!!!");' with a blank between them, it works well too:
<rhs>System.out.println("Hello"); manageAlert("impossibleRule!!!"); manageRuleFired("Impossible Rule");</rhs>
<rhs>manageAlert("impossibleRule!!!"); System.out.println("Hello"); manageRuleFired("Impossible Rule");</rhs>
...
I attach a test case with the xml rule file that cause the rule compilation error and the main class to test it.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 10 months