[jboss-jira] [JBoss JIRA] Commented: (JBRULES-562) Security Permission problem in Websphere 6.1

[ http://jira.jboss.com/jira/browse/JBRULES-562?page=comments#action_12347209 ] Edson Tirelli commented on JBRULES-562: --------------------------------------- Hi Michael and Edson, I fixed the problem with the generated class files today. However I'm not sure yet whether I have broken something else. Basically I pulled in the cglib code into ClassFieldExtractorFactory (file and patch attached). That was all fine however I was getting a duplicate class error when running the pricing tests. So I changed ClassFieldExtractorCache to use a static cache rather than an instance. I did these changes in the middle of a meeting and then emailed the jars to a guy on my team who tested them so I wasn't really analysing the issues, just fixing them. Anyway just doing it tonight I don't get that problem so I will check again tomorrow. cheers Steve +++ D:/drools-3.0.x/drools-core/src/main/java/org/drools/base/ClassFieldExtractorFactory.java (working copy) @@ -18,6 +18,9 @@ import java.beans.IntrospectionException; import java.lang.reflect.Method; +import java.security.AccessController; +import java.security.PrivilegedAction; +import java.security.ProtectionDomain; import org.drools.RuntimeDroolsException; import org.drools.asm.ClassWriter; @@ -37,14 +40,40 @@ public class ClassFieldExtractorFactory { - private static final String GETTER = "get"; + private static final String GETTER = "get"; - private static final String BOOLEAN_GETTER = "is"; + private static final String BOOLEAN_GETTER = "is"; - private static final String BASE_PACKAGE = "org/drools/base"; + private static final String BASE_PACKAGE = "org/drools/base"; - private static final String BASE_EXTRACTOR = "org/drools/base/BaseClassFieldExtractor"; + private static final String BASE_EXTRACTOR = "org/drools/base/BaseClassFieldExtractor"; + private static Method DEFINE_CLASS; + private static final ProtectionDomain PROTECTION_DOMAIN; + static { + PROTECTION_DOMAIN = (ProtectionDomain) AccessController.doPrivileged( new PrivilegedAction() { + public Object run() { + return ClassFieldExtractorFactory.class.getProtectionDomain(); + } + } ); + + AccessController.doPrivileged( new PrivilegedAction() { + public Object run() { + try { + Class loader = Class.forName( "java.lang.ClassLoader" ); // JVM crash w/o this + DEFINE_CLASS = loader.getDeclaredMethod( "defineClass", + new Class[]{String.class, byte[].class, Integer.TYPE, Integer.TYPE, ProtectionDomain.class} ); + DEFINE_CLASS.setAccessible( true ); + } catch ( ClassNotFoundException e ) { + throw new RuntimeDroolsException( e ); + } catch ( NoSuchMethodException e ) { + throw new RuntimeDroolsException( e ); + } + return null; + } + } ); + } + public static BaseClassFieldExtractor getClassFieldExtractor(final Class clazz, final String fieldName) { try { @@ -64,13 +93,17 @@ clazz.isInterface() ); // use bytes to get a class ClassLoader parent = Thread.currentThread().getContextClassLoader(); - if( parent == null ) { + if ( parent == null ) { parent = ClassFieldExtractorFactory.class.getClassLoader(); } - final ByteArrayClassLoader classLoader = new ByteArrayClassLoader( parent ); - final Class newClass = classLoader.defineClass( className.replace( '/', - '.' ), - bytes ); + // final ByteArrayClassLoader classLoader = new ByteArrayClassLoader( parent ); + // final Class newClass = classLoader.defineClass( className.replace( '/', + // '.' ), + // bytes ); + final Class newClass = defineClass( className.replace( '/', + '.' ), + bytes, + parent ); // instantiating target class final Object[] params = {clazz, fieldName}; return (BaseClassFieldExtractor) newClass.getConstructors()[0].newInstance( params ); @@ -79,6 +112,14 @@ } } + public static Class defineClass(String className, + byte[] b, + ClassLoader loader) throws Exception { + Object[] args = new Object[]{className, b, new Integer( 0 ), new Integer( b.length ), PROTECTION_DOMAIN}; + return (Class) DEFINE_CLASS.invoke( loader, + args ); + } + private static byte[] dump(final String originalClassName, final String className, final String getterName, @@ -209,7 +250,7 @@ 2 ); mv.visitEnd(); } else { - String typeNotation = fieldType.isArray() ? typeName : "L"+typeName+";"; + String typeNotation = fieldType.isArray() ? typeName : "L" + typeName + ";"; mv = cw.visitMethod( Opcodes.ACC_PUBLIC, "getValue", "(Ljava/lang/Object;)Ljava/lang/Object;", -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira