[JBoss JIRA] Created: (JBAS-6725) quotes around JAVA_OPTS in run.bat
by David Croft (JIRA)
quotes around JAVA_OPTS in run.bat
----------------------------------
Key: JBAS-6725
URL: https://jira.jboss.org/jira/browse/JBAS-6725
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: JBossAS-5.1.0.Beta1, JBossAS-5.0.1.GA
Environment: Windows XP and JDK 6
Reporter: David Croft
In JBoss 4.2.3, I was able to prepend to run.bat a JAVA_OPTS option with a pipe symbol (|) by escaping it using quote marks.
Example:
set JAVA_OPTS=-Dhttp.nonProxyHosts="localhost|*.ldms.ibm.com"
In JBoss 5.0.1.GA and 5.1.0.Beta1, the run.bat script has been modified slightly so that this is no longer possible. This modification was to wrap JAVA_OPTS with quote marks which will not parse if JAVA_OPTS already has quote marks as in the above example. There are two places where this occurs. Here is the first place:
if "x%JAVA_OPTS%" == "x" (
set "JAVA_OPTS=-Dprogram.name=%PROGNAME%"
) else (
set "JAVA_OPTS=%JAVA_OPTS% -Dprogram.name=%PROGNAME%"
)
The first place where it occurs can be fixed by reverting to the version 4.2.3 run.bat code without quote marks:
set JAVA_OPTS=%JAVA_OPTS% -Dprogram.name=%PROGNAME%
The second place it occurs is as follows:
if not errorlevel == 1 (
set "JAVA_OPTS=%JAVA_OPTS% -server"
)
This second place can be fixed by removing the quote marks:
if not errorlevel == 1 (
set JAVA_OPTS=%JAVA_OPTS% -server
)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 10 months
[JBoss JIRA] Created: (JBREM-929) Secure remote classloading
by David Lloyd (JIRA)
Secure remote classloading
--------------------------
Key: JBREM-929
URL: http://jira.jboss.com/jira/browse/JBREM-929
Project: JBoss Remoting
Issue Type: Task
Security Level: Public (Everyone can see)
Reporter: David Lloyd
Fix For: 3.0.0-M3
Remote classloading should be allowed only if either (a) a security manager is installed (and thus the security manager would create the policy) or (b) a specific option is enabled (which would be disabled by default) to allow it.
Also, the remote classloader needs to be able to work with the standard security manager policy - which is to say, that classes loaded from a remote service need to have a unique codeBase URL so that administrators can grant permission to remote classes based on the service from whence they came.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 10 months