Author: remy.maucherat(a)jboss.com Date: 2015-09-01 07:52:49 -0400 (Tue, 01 Sep 2015) New Revision: 2623 Modified: branches/7.5.x/src/main/java/org/apache/jasper/Constants.java branches/7.5.x/src/main/java/org/apache/jasper/compiler/JspRuntimeContext.java Log: BZ1075083: Use the right code source if provided. Submitted by Bartek Spyrko-Smietanko. Modified: branches/7.5.x/src/main/java/org/apache/jasper/Constants.java =================================================================== --- branches/7.5.x/src/main/java/org/apache/jasper/Constants.java 2015-08-26 07:41:16 UTC (rev 2622) +++ branches/7.5.x/src/main/java/org/apache/jasper/Constants.java 2015-09-01 11:52:49 UTC (rev 2623) @@ -154,4 +154,6 @@ */ public static final String SESSION_PARAMETER_NAME = System.getProperty("org.apache.catalina.jsessionid", "jsessionid"); + public static final String PERMISSION_COLLECTION_ATTRIBUTE_NAME = "org.apache.jasper.Constants.PERMISSION_COLLECTION_ATTRIBUTE_NAME"; + public static final String CODE_SOURCE_ATTRIBUTE_NAME = "org.apache.jasper.Constants.CODE_SOURCE_ATTRIBUTE_NAME"; } Modified: branches/7.5.x/src/main/java/org/apache/jasper/compiler/JspRuntimeContext.java =================================================================== --- branches/7.5.x/src/main/java/org/apache/jasper/compiler/JspRuntimeContext.java 2015-08-26 07:41:16 UTC (rev 2622) +++ branches/7.5.x/src/main/java/org/apache/jasper/compiler/JspRuntimeContext.java 2015-09-01 11:52:49 UTC (rev 2623) @@ -363,7 +363,12 @@ } File contextDir = new File(codeBase); URL url = contextDir.getCanonicalFile().toURL(); - codeSource = new CodeSource(url,(Certificate[])null); + URL providedCodeSource = (URL) context.getAttribute(Constants.CODE_SOURCE_ATTRIBUTE_NAME); + if (providedCodeSource != null) { + codeSource = new CodeSource(providedCodeSource, (Certificate[]) null); + } else { + codeSource = new CodeSource(url,(Certificate[])null); + } permissionCollection = policy.getPermissions(codeSource); // Create a file read permission for web app context directory