[ https://issues.jboss.org/browse/AS7-6684?page=com.atlassian.jira.plugin.s... ] Remy Maucherat commented on AS7-6684: ------------------------------------- The relevant code is in o.a.jasper.compiler.JspRuntimeContext.initSecurity and is very readable about what it does. What would be the concrete suggestions to overhaul it ? - It uses Policy.getPermissions(CodeSource) to add permissions. An alternative is to use Policy.getPermissions(new ProtectionDomain(CodeSource, etc)) to do the same thing. - The CodeSource used is the work folder URL if the webapp is not exploded (if it is, it should be using the deployment folder URL), because the code thinks it is a good idea to use a path that is actually usable, rather than some arbitrary path. If I understand, you would prefer to use the (absolute canonical) deployment path URL instead ? -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira