[JBoss JIRA] Created: (JBREM-929) Secure remote classloading
by David Lloyd (JIRA)
Secure remote classloading
--------------------------
Key: JBREM-929
URL: http://jira.jboss.com/jira/browse/JBREM-929
Project: JBoss Remoting
Issue Type: Task
Security Level: Public (Everyone can see)
Reporter: David Lloyd
Fix For: 3.0.0-M3
Remote classloading should be allowed only if either (a) a security manager is installed (and thus the security manager would create the policy) or (b) a specific option is enabled (which would be disabled by default) to allow it.
Also, the remote classloader needs to be able to work with the standard security manager policy - which is to say, that classes loaded from a remote service need to have a unique codeBase URL so that administrators can grant permission to remote classes based on the service from whence they came.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 8 months
[JBoss JIRA] Created: (JBREM-1170) System.gc() should not call in ServerInvokerCallbackHandler
by ryu ken (JIRA)
System.gc() should not call in ServerInvokerCallbackHandler
-----------------------------------------------------------
Key: JBREM-1170
URL: https://jira.jboss.org/jira/browse/JBREM-1170
Project: JBoss Remoting
Issue Type: Quality Risk
Security Level: Public (Everyone can see)
Components: callbacks
Affects Versions: 2.2.2.SP11
Reporter: ryu ken
It seems System.gc() will be call when Memory Low has been detected.
In fact, calling System.gc() may cause performance problems.
handleCallback():
// need to check if should persist callback instead of keeping in memory
if(shouldPersist())
{
try
{
persistCallback(callback);
synchronized (callbacks)
{
callbacks.notify();
}
callback = null;
// try to help out with the amount of memory usuage
new Thread()
{
public void run()
{
System.gc();
}
}.start();
}
catch(IOException e)
{
log.error("Unable to persist callback", e);
throw new HandleCallbackException("Unable to persist callback and will not " +
"be able to deliver.", e);
}
}
getPersistedCallbacks():
if(isMemLow())
{
new Thread()
{
public void run()
{
System.gc();
}
}.start();
break;
}
isMemLow():
Runtime runtime = Runtime.getRuntime();
long max = runtime.maxMemory();
long total = runtime.totalMemory();
long free = runtime.freeMemory();
float percentage = 100 * free / total;
if(max == total && memPercentCeiling >= percentage)
{
return true;
}
else
{
return false;
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 10 months