July 2007 - jboss-jira - Jboss List Archives

[JBoss JIRA] Created: (JBRULES-760) Security problem in WebSphere with PackageCompilationData classloader

by Carey Evans (JIRA)

Security problem in WebSphere with PackageCompilationData classloader --------------------------------------------------------------------- Key: JBRULES-760 URL: http://jira.jboss.com/jira/browse/JBRULES-760 Project: JBoss Rules Issue Type: Bug Security Level: Public (Everyone can see) Components: Reteoo Affects Versions: 3.0.6 Environment: WebSphere Application Server 6.0.2.17 Express with IBM JDK 1.4.2 SR5 on Windows Server 2003 Reporter: Carey Evans Assigned To: Mark Proctor This problem is very similar to JBRULES-562, but affects classes loaded by org.drools.rule.PackageCompilationData.PackageClassLoader rather than org.drools.base.ClassFieldExtractorFactory. The symptoms are the same: [29/03/07 16:18:44:279 NZST] 00000034 SecurityManag W SECJ0314W: Current Java 2 Security policy reported a potential violation of Java 2 Security Permission. Please refer to Problem Determination Guide for further information. Permission: accessDeclaredMembers : access denied (java.lang.RuntimePermission accessDeclaredMembers) Code: BrowseCatalog.Rule_Bad_Rule_0 in {null code URL} Stack Trace: java.security.AccessControlException: access denied (java.lang.RuntimePermission accessDeclaredMembers) [...] at java.lang.Class.getDeclaredConstructor(Class.java(Compiled Code)) at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:60) [...] at com.elasticpath.domain.rules.impl.PromotionRuleDelegateImpl.isFirstTimeBuyer(PromotionRuleDelegateImpl.java:975) at BrowseCatalog.Rule_Bad_Rule_0.eval1(Rule_Bad_Rule_0.java:16) at BrowseCatalog.Rule_Bad_Rule_0Eval1Invoker.evaluate(Rule_Bad_Rule_0Eval1Invoker.java:20) at org.drools.rule.EvalCondition.isAllowed(Unknown Source) [...] Code Base Location: [...] BrowseCatalog.Rule_Bad_Rule_0 : null code URL ClassLoader: org.drools.rule.PackageCompilationData$PackageClassLoader Permissions granted to CodeSource (null <no certificates>) { } BrowseCatalog.Rule_Bad_Rule_0Eval1Invoker : null code URL ClassLoader: org.drools.rule.PackageCompilationData$PackageClassLoader Permissions granted to CodeSource (null <no certificates>) { } I've made the same change to PackageCompilationData as was made to ClassFieldExtractorFactory, which has fixed the problem: --- drools-core/src/main/java/org/drools/rule/PackageCompilationData.java (revision 10605) +++ drools-core/src/main/java/org/drools/rule/PackageCompilationData.java (working copy) @@ -24,6 +24,9 @@ import java.io.ObjectInput; import java.io.ObjectOutput; import java.io.ObjectOutputStream; +import java.security.AccessController; +import java.security.PrivilegedAction; +import java.security.ProtectionDomain; import java.util.ArrayList; import java.util.HashMap; import java.util.Iterator; @@ -47,6 +50,16 @@ */ private static final long serialVersionUID = -4351259299237235523L; + private static final ProtectionDomain PROTECTION_DOMAIN; + + static { + PROTECTION_DOMAIN = (ProtectionDomain) AccessController.doPrivileged( new PrivilegedAction() { + public Object run() { + return PackageCompilationData.class.getProtectionDomain(); + } + } ); + } + private Map invokerLookups = new HashMap(); private Object AST; @@ -280,7 +293,8 @@ return defineClass( name, clazzBytes, 0, - clazzBytes.length ); + clazzBytes.length, + PROTECTION_DOMAIN ); } } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

2
3
0 / 0

[JBoss JIRA] Created: (JBRULES-972) Implement shallow shadow for collection, maps and array attributes.

by Edson Tirelli (JIRA)

Implement shallow shadow for collection, maps and array attributes. ------------------------------------------------------------------- Key: JBRULES-972 URL: http://jira.jboss.com/jira/browse/JBRULES-972 Project: JBoss Rules Issue Type: Feature Request Security Level: Public (Everyone can see) Reporter: Edson Tirelli Assigned To: Edson Tirelli Priority: Blocker -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

3
3
0 / 0

[JBoss JIRA] Created: (JBRULES-724) Add PackageBuilder.add... (String packageName, ...) for passing in package name context

by Michael Neale (JIRA)

Add PackageBuilder.add... (String packageName, ...) for passing in package name context --------------------------------------------------------------------------------------- Key: JBRULES-724 URL: http://jira.jboss.com/jira/browse/JBRULES-724 Project: JBoss Rules Issue Type: Feature Request Security Level: Public (Everyone can see) Affects Versions: 3.1-m2 Reporter: Michael Neale Assigned To: Mark Proctor Fix For: 3.1-m3 Need to be able to parse stuff without having to slap the package at the top. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

2
2
0 / 0

[JBoss JIRA] Closed: (JBRULES-350) client/server API for rule deployment and management

by Mark Proctor (JIRA)

[ http://jira.jboss.com/jira/browse/JBRULES-350?page=all ] Mark Proctor closed JBRULES-350. -------------------------------- Resolution: Duplicate Issue > client/server API for rule deployment and management > ---------------------------------------------------- > > Key: JBRULES-350 > URL: http://jira.jboss.com/jira/browse/JBRULES-350 > Project: JBoss Rules > Issue Type: Feature Request > Security Level: Public(Everyone can see) > Reporter: Mark Proctor > Assigned To: Mark Proctor > Fix For: 4.0.0.MR4 > > > We need a API to handle package and rulebase deployment as well as management. Initially research shows that Jboss Remoting will be an ideal solution to provide a remote access API. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

1
0
0 / 0

[JBoss JIRA] Created: (JBPORTAL-1456) It is impossible to delete once entered user profile property

by Ryszard Kozmik (JIRA)

It is impossible to delete once entered user profile property ------------------------------------------------------------- Key: JBPORTAL-1456 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1456 Project: JBoss Portal Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: 2.6.CR2, 2.4.1 Final, 2.2.1 Final Reporter: Ryszard Kozmik Priority: Minor Fix For: 2.2.2 Final, 2.6 Final, 2.8 Final, 2.4.2 Final, 2.4.3 Final Reproducing the bug: 1) login to portal 2) enter edit user profile information view 3) Add something (name, ICQ, AIM whatever) 4) Save changes 5) enter edit user profile information view again 6) delete previously entered info 7) save changes 8) enter edit user profile information view and notice that information was not deleted -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

3
4
0 / 0

[JBoss JIRA] Created: (JBPORTAL-1307) Add Google Talk / Jabber to list of "Instant Message Identities".

by oberiko (JIRA)

Add Google Talk / Jabber to list of "Instant Message Identities". ----------------------------------------------------------------- Key: JBPORTAL-1307 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1307 Project: JBoss Portal Issue Type: Feature Request Security Level: Public (Everyone can see) Affects Versions: 2.6.Alpha2 Reporter: oberiko Priority: Minor It'd be nice if the "Instant Message Identities" section of the user profile included a field for Google Talk / Jabber. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

3
3
0 / 0

[JBoss JIRA] Created: (JBRULES-446) Support rulebase configuration via jsr94 registerRuleExecutionSet properties

by Juergen none (JIRA)

Support rulebase configuration via jsr94 registerRuleExecutionSet properties ---------------------------------------------------------------------------- Key: JBRULES-446 URL: http://jira.jboss.com/jira/browse/JBRULES-446 Project: JBoss Rules Issue Type: Feature Request Security Level: Public (Everyone can see) Components: JSR94 Affects Versions: 3.0.4 Reporter: Juergen none Assigned To: Mark Proctor Priority: Minor Is it possible to support rulebase configuration via jsr94 registerRuleExecutionSet properties? Suggestion: - new property in org.drools.jsr94.rules.Constants.java:41: //jh: added to support handing a rulebase config via jsr94 /** <code>RuleExecutionSet</code> rulebase config constant. */ public static final String RES_CONFIG = "javax.rules.admin.RuleExecutionSet.config"; - modification of method (probably secure against ClassCastException) org.drools.jsr94.rules.admin.RuleExecutionSetImpl.java:118:RuleExecutionSetImpl(...): //jh: support rulebase configuration via jsr94 final org.drools.reteoo.ReteooRuleBase ruleBase = new org.drools.reteoo.ReteooRuleBase((org.drools.RuleBaseConfiguration)properties.get(org.drools.jsr94.rules.Constants.RES_CONFIG), new Jsr94FactHandleFactory() ); /* final org.drools.reteoo.ReteooRuleBase ruleBase = new org.drools.reteoo.ReteooRuleBase( new Jsr94FactHandleFactory() ); */ -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

2
5
0 / 0

[JBoss JIRA] Created: (JBRULES-528) Implementation for Decision tables, and compiler options in DroolsJSR

by Vignesh S (JIRA)

Implementation for Decision tables, and compiler options in DroolsJSR --------------------------------------------------------------------- Key: JBRULES-528 URL: http://jira.jboss.com/jira/browse/JBRULES-528 Project: JBoss Rules Issue Type: Feature Request Security Level: Public (Everyone can see) Components: JSR94 Reporter: Vignesh S Assigned To: Mark Proctor Priority: Optional The implementation for Decision tables and compiler options can be given in drools JSR and to my knowledge it can done easily in the method public RuleExecutionSet createRuleExecutionSet(final Reader ruleExecutionSetReader, final Map properties) throws RuleExecutionSetCreateException org.drools.jsr94.rules.admin.LocalRuleExecutionSetProviderImpl class By adding one more condition for ".xsl" for decision tables and setting a new property for the compiler in map parameter -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

3
4
0 / 0

[JBoss JIRA] Created: (JBMESSAGING-1006) We should throw an exception if recoverDelivery fails

by Clebert Suconic (JIRA)

We should throw an exception if recoverDelivery fails ----------------------------------------------------- Key: JBMESSAGING-1006 URL: http://jira.jboss.com/jira/browse/JBMESSAGING-1006 Project: JBoss Messaging Issue Type: Bug Affects Versions: 1.3.0.GA Reporter: Clebert Suconic Assigned To: Clebert Suconic Fix For: 1.4.0.GA If recoverDelivery can't find a message, it means that another consumer already received that message during mergeQueue What means... failover should fail on that situation. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

1
7
0 / 0

[JBoss JIRA] Created: (JBPORTAL-1513) build.sh and build.bat into testsuite project

by Luca Stancapiano (JIRA)

build.sh and build.bat into testsuite project --------------------------------------------- Key: JBPORTAL-1513 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1513 Project: JBoss Portal Issue Type: Patch Security Level: Public (Everyone can see) Components: Portal Core Affects Versions: 2.6 CR3 Environment: jboss portal from http://anonsvn.jboss.org/repos/portal/trunk since 27 jun 2007 Reporter: Luca Stancapiano Assigned To: Julien Viet Fix For: 2.6 Final .....but build.bat and build.sh into testsuite project.....do you want to use them? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

19 years

3
4
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira July 2007