Author: david.lloyd(a)jboss.com Date: 2008-07-21 14:36:10 -0400 (Mon, 21 Jul 2008) New Revision: 4420 Modified: remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationMarhsaller.java remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationUnmarshaller.java Log: Make object replacement be a privileged action Modified: remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationMarhsaller.java =================================================================== --- remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationMarhsaller.java 2008-07-21 18:31:12 UTC (rev 4419) +++ remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationMarhsaller.java 2008-07-21 18:36:10 UTC (rev 4420) @@ -4,6 +4,8 @@ import java.io.OutputStream; import java.io.ObjectOutputStream; import java.util.concurrent.Executor; +import java.security.AccessController; +import java.security.PrivilegedAction; import org.jboss.cx.remoting.spi.marshal.ObjectResolver; import org.jboss.cx.remoting.spi.marshal.IdentityResolver; import org.jboss.xnio.log.Logger; @@ -28,7 +30,12 @@ private OurObjectOutputStream(final OutputStream outputStream, final ObjectResolver resolver) throws IOException { super(outputStream); - enableReplaceObject(true); + AccessController.doPrivileged(new PrivilegedAction<Void>() { + public Void run() { + enableReplaceObject(true); + return null; + } + }); this.resolver = resolver; } Modified: remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationUnmarshaller.java =================================================================== --- remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationUnmarshaller.java 2008-07-21 18:31:12 UTC (rev 4419) +++ remoting3/trunk/core/src/main/java/org/jboss/cx/remoting/core/marshal/JavaSerializationUnmarshaller.java 2008-07-21 18:36:10 UTC (rev 4420) @@ -30,6 +30,8 @@ import java.util.Map; import java.util.HashMap; import java.lang.reflect.Proxy; +import java.security.AccessController; +import java.security.PrivilegedAction; import org.jboss.cx.remoting.spi.marshal.ObjectResolver; /** @@ -54,6 +56,12 @@ private OurObjectInputStream(final InputStream inputStream, final ObjectResolver resolver, final ClassLoader classLoader) throws IOException { super(inputStream); + AccessController.doPrivileged(new PrivilegedAction<Void>() { + public Void run() { + enableResolveObject(true); + return null; + } + }); this.classLoader = classLoader; this.resolver = resolver; }