[jboss-jira] [JBoss JIRA] (AS7-6316) Review of AccessController and PrivilegedAction use across AS7

Review of AccessController and PrivilegedAction use across AS7 -------------------------------------------------------------- Key: AS7-6316 URL: https://issues.jboss.org/browse/AS7-6316 Project: Application Server 7 Issue Type: Task Components: Security Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Critical Fix For: 7.2.0.Alpha1 The following needs reviewing across AS7: - - On demand instantiation of PrivilegedActions where singletons would suffice (Consider frequency of calls, gc may be preferable). - Use of AccessController even though there is no SecurityManager set. - Code duplication, in every case I have seen so far the code is the same regardless of if PRIVILEGED or NON_PRIVILEGED - Utility methods with visibility too high. - In depth review of the other methods, i.e. if the first thing a public method does is set the class loader based on a parameter passed in it could be used badly - it may even be a justification for that method to NOT use a PrivilegedAction. - Code that requires to be executed using a PrivilegedAction should also be double checked that it is not doing too much as the identity of the caller.