[hibernate-issues] [Hibernate-JIRA] Created: (HV-171) JSR-303 must specify how to run in environments that use a SecurityManager

[Ed Burns (JIRA)]

JSR-303 must specify how to run in environments that use a SecurityManager
--------------------------------------------------------------------------

                 Key: HV-171
                 URL: http://opensource.atlassian.com/projects/hibernate/browse/HV-171
             Project: Hibernate Validator
          Issue Type: Improvement
          Components: documentation
    Affects Versions: 4.0.0.Beta1
         Environment: Glassfish V3 with Security Manager Enabled
            Reporter: Ed Burns


When running the JSR-303 Impl that is Hibernate Validator 4.0.0.Beta1 on a container with a SecurityManager, such as Glassfishv3 with the SecurityManager enabled, calling simple validator code such as:

        Set<ConstraintViolation<Person>> violations = 
            beanValidator.validate(person);

Will cause an AccessControlException, as shown in the following stack trace:

 [#|2009-06-19T11:22:20.347-0400|SEVERE|glassfish|javax.enterprise.system.container.web.com.sun.enterprise.web|_ThreadID=17;_ThreadName=Thread-1;|StandardWrapperValve[SimpleBVServlet]: PWC1406: Servlet.service() for servlet SimpleBVServlet threw exception
java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks)
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
	at java.security.AccessController.checkPermission(AccessController.java:546)
	at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
	at java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:107)
	at org.hibernate.validation.util.ReflectionHelper.setAccessibility(ReflectionHelper.java:195)
	at org.hibernate.validation.engine.BeanMetaDataImpl.initFieldConstraints(BeanMetaDataImpl.java:233)
	at org.hibernate.validation.engine.BeanMetaDataImpl.initClass(BeanMetaDataImpl.java:207)
	at org.hibernate.validation.engine.BeanMetaDataImpl.createMetaData(BeanMetaDataImpl.java:179)
	at org.hibernate.validation.engine.BeanMetaDataImpl.<init>(BeanMetaDataImpl.java:106)
	at org.hibernate.validation.engine.BeanMetaDataImpl.<init>(BeanMetaDataImpl.java:96)
	at org.hibernate.validation.engine.ValidatorImpl.getBeanMetaData(ValidatorImpl.java:559)
	at org.hibernate.validation.engine.ValidatorImpl.validateConstraints(ValidatorImpl.java:225)
	at org.hibernate.validation.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:189)
	at org.hibernate.validation.engine.ValidatorImpl.validate(ValidatorImpl.java:110)
	at simple_bv_servlet.SimpleBVServlet.doGet(SimpleBVServlet.java:76)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:734)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:319)
	at java.security.AccessController.doPrivileged(Native Method)
	at javax.security.auth.Subject.doAsPrivileged(Subject.java:517)
	at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:352)
	at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:209)
	at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1499)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:293)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:187)
	at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:641)
	at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:97)
	at com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:85)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:185)
	at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:353)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:249)
	at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:147)
	at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:746)
	at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:655)
	at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:905)
	at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:161)
	at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:136)
	at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:103)
	at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:89)
	at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
	at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
	at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
	at com.sun.grizzly.ContextTask.run(ContextTask.java:69)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
	at java.lang.Thread.run(Thread.java:637)

Some remedies include:

1. Explicitly accounting for SecurityManager considerations in the JSR-303 Java API

2. Mentioning in the spec prose what a caller that wishes to use SecurityManager must do to enable JSR-303 to work without throwing security related exceptions.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira