[jboss-cvs] JBossAS SVN: r64305 - in projects/aop/trunk/aop/src/main/org/jboss/aop: advice and 8 other directories.

jboss-cvs-commits at lists.jboss.org jboss-cvs-commits at lists.jboss.org
Thu Jul 26 10:58:14 EDT 2007


Author: adrian at jboss.org
Date: 2007-07-26 10:58:14 -0400 (Thu, 26 Jul 2007)
New Revision: 64305

Added:
   projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/hook/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/SecurityActions.java
Modified:
   projects/aop/trunk/aop/src/main/org/jboss/aop/Advisor.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/AdvisorFactory.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/AspectAnnotationLoader.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/AspectManager.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/AspectXmlLoader.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/ClassAdvisor.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/Deployment.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/advice/AspectFactoryWithClassLoaderSupport.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/advice/DynamicCFlowDefinition.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/advice/GenericInterceptorFactory.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/advice/PerVmAdvice.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/advice/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/ByteCodeAnnotationCompiler.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/contrib/IDEClassPoolFactory.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/eclipsesupport/EclipseTestTransformer.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GenerateInstrumentedClassLoader.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GeneratePluggableInstrumentedClassLoader.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/InstrumentorFactory.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/JoinPointGenerator.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/TransformerCommon.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/CFlow.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/MatcherStrategy.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/ProxyMatcherStrategy.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/Util.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/MarshalledInterfaceProxy.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/SecurityActions.java
   projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/ClassProxyContainer.java
Log:
Make sure all access to the TCL is done in privileged blocks (if necessary) and comment dubious uses with FIXME Classloader...

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/Advisor.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/Advisor.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/Advisor.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -382,7 +382,8 @@
          {
             if (annotationClass == null)
             {
-               annotationClass = Thread.currentThread().getContextClassLoader().loadClass(annotation);
+               // FIXME ClassLoader - this should use "tgt.getClassLoader()"
+               annotationClass = SecurityActions.getContextClassLoader().loadClass(annotation);
             }
             // FIXME The metadata should already include the class annotations
             //       so we should just return this result
@@ -490,7 +491,10 @@
          if (metadata != null)
          {
             if (annotationClass == null)
-               annotationClass = Thread.currentThread().getContextClassLoader().loadClass(annotation);
+            {
+               // FIXME ClassLoader - this should use "m.getClass().getClassLoader()"
+               annotationClass = SecurityActions.getContextClassLoader().loadClass(annotation);
+            }
             // FIXME The metadata should already include the class annotations
             //       so we should just return this result
             MethodSignature signature = new MethodSignature(m.getName(), m.getParameterTypes());

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/AdvisorFactory.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/AdvisorFactory.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/AdvisorFactory.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -71,7 +71,8 @@
          {         
             try
             {
-               Class otherAdvisorClass = Thread.currentThread().getContextClassLoader().loadClass(property);
+               // FIXME ClassLoader - why should this class be visible from the context classloader?
+               Class otherAdvisorClass = SecurityActions.getContextClassLoader().loadClass(property);
                otherAdvisorConstructor = otherAdvisorClass.getConstructor(CONSTRUCTOR_SIG);
             }
             catch (ClassNotFoundException e)

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/AspectAnnotationLoader.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/AspectAnnotationLoader.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/AspectAnnotationLoader.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -99,12 +99,12 @@
       this.cl = cl;
    }
    
+   // REVIEW ClassLoader - This method doesn't seem to get used? - Generated code?
    public ClassLoader getClassLoader()
    {
+      // FIXME ClassLoader - shouldn't this always have the correct classloader? - the deployment classloader
       if (cl == null)
-      {
-         return Thread.currentThread().getContextClassLoader();
-      }
+         return SecurityActions.getContextClassLoader();
       return cl;
    }
 

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/AspectManager.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/AspectManager.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/AspectManager.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -227,7 +227,7 @@
 
    public static synchronized AspectManager instance()
    {
-      return instance(Thread.currentThread().getContextClassLoader());
+      return instance(SecurityActions.getContextClassLoader());
    }
    
    /**
@@ -711,7 +711,7 @@
       if (!(cl instanceof Translatable))
       {
          // findClassPool has problems with boot and system classes.
-         return registerClassLoader(Thread.currentThread().getContextClassLoader());
+         return registerClassLoader(SecurityActions.getContextClassLoader());
       }
       return registerClassLoader(cl);
    }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/AspectXmlLoader.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/AspectXmlLoader.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/AspectXmlLoader.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -117,9 +117,7 @@
    public ClassLoader getClassLoader()
    {
       if (cl == null)
-      {
-         return Thread.currentThread().getContextClassLoader();
-      }
+         return SecurityActions.getContextClassLoader();
       return cl;
    }
 

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/ClassAdvisor.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/ClassAdvisor.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/ClassAdvisor.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -384,11 +384,13 @@
          for (int i = 0; i < mixins.size(); i++)
          {
             InterfaceIntroduction.Mixin mixin = (InterfaceIntroduction.Mixin) mixins.get(i);
-            Thread.currentThread().getContextClassLoader().loadClass(mixin.getClassName());
+            // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+            ClassLoader cl = SecurityActions.getContextClassLoader();
+            cl.loadClass(mixin.getClassName());
             String[] interfaces = mixin.getInterfaces();
             for (int j = 0; j < interfaces.length; j++)
             {
-               Class intf = Thread.currentThread().getContextClassLoader().loadClass(interfaces[j]);
+               Class intf = cl.loadClass(interfaces[j]);
                if (intf.isAssignableFrom(clazz))//This is a fix for JBAOP-365. Class may have been woven, with the extra mixin information only available at init time
                {
                   Method[] methods = intf.getMethods();
@@ -658,7 +660,8 @@
 
       //The standard MethodCalledByXXXXInvocation class calls by reflection and needs access
       calledMethod.setAccessible(true);
-      Class calledClazz = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+      // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+      Class calledClazz = SecurityActions.getContextClassLoader().loadClass(calledClass);
       MethodByConInfo info = new MethodByConInfo(this, calledClazz, callingClass, callingIndex, calledMethod, calledMethodHash, null);
       calledMethodsMap.put(calledMethodHash, info);
       return info;
@@ -688,7 +691,8 @@
    {
       //The standard ConstructorCalledByXXXXInvocation class calls by reflection and needs access
       calledCon.setAccessible(true);
-      Class calledClazz = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+      // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+      Class calledClazz = SecurityActions.getContextClassLoader().loadClass(calledClass);
 
       try
       {
@@ -1261,7 +1265,8 @@
       {
          Constructor callingConstructor = constructors[callingIndex];
          if (callingConstructor == null) throw new RuntimeException("Unable to figure out calling method of a caller pointcut");
-         Class called = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+         // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+         Class called = SecurityActions.getContextClassLoader().loadClass(calledClass);
          Method calledMethod = MethodHashing.findMethodByHash(called, calledMethodHash);
          if (calledMethod == null) throw new RuntimeException("Unable to figure out calledmethod of a caller pointcut");
 
@@ -1328,7 +1333,8 @@
       {
          Constructor callingConstructor = constructors[callingIndex];
          if (callingConstructor == null) throw new RuntimeException("Unable to figure out calling method of a caller pointcut");
-         Class called = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+         // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+         Class called = SecurityActions.getContextClassLoader().loadClass(calledClass);
          Constructor calledCon = MethodHashing.findConstructorByHash(called, calledConHash);
          if (calledCon == null) throw new RuntimeException("Unable to figure out calledcon of a caller pointcut");
 
@@ -2069,7 +2075,8 @@
          {
             Method callingMethod = MethodHashing.findMethodByHash(clazz, callingMethodHash);
             if (callingMethod == null) throw new RuntimeException("Unable to figure out calling method of a caller pointcut");
-            Class called = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+            // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+            Class called = SecurityActions.getContextClassLoader().loadClass(calledClass);
             Method calledMethod = MethodHashing.findMethodByHash(called, calledMethodHash);
             if (calledMethod == null) throw new RuntimeException("Unable to figure out calledmethod of a caller pointcut");
 
@@ -2176,7 +2183,8 @@
          //The standard MethodCalledByXXXXInvocation class calls by reflection and needs access
          calledMethod.setAccessible(true);
 
-         Class calledClazz = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+         // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+         Class calledClazz = SecurityActions.getContextClassLoader().loadClass(calledClass);
          MethodByMethodInfo info = new MethodByMethodInfo(ClassAdvisor.this, calledClazz, calledMethod, callingMethod, callingMethodHash, calledMethodHash, null);
          calledMethodsMap.put(calledMethodHash, info);
          return info;
@@ -2302,7 +2310,8 @@
          {
             Method callingMethod = MethodHashing.findMethodByHash(clazz, callingMethodHash);
             if (callingMethod == null) throw new RuntimeException("Unable to figure out calling method of a constructor caller pointcut");
-            Class called = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+            // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+            Class called = SecurityActions.getContextClassLoader().loadClass(calledClass);
             Constructor calledCon = MethodHashing.findConstructorByHash(called, calledConHash);
             if (calledCon == null) throw new RuntimeException("Unable to figure out calledcon of a constructor caller pointcut");
 
@@ -2425,7 +2434,8 @@
          //The standard ConstructorCalledByXXXXInvocation class calls by reflection and needs access
          calledCon.setAccessible(true);
 
-         Class calledClazz = Thread.currentThread().getContextClassLoader().loadClass(calledClass);
+         // FIXME ClassLoader - how do we know the class is visible from the context classloader?
+         Class calledClazz = SecurityActions.getContextClassLoader().loadClass(calledClass);
          try
          {
             int index = calledClass.lastIndexOf('.');

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/Deployment.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/Deployment.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/Deployment.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -74,7 +74,7 @@
       {
          try
          {
-            Enumeration en = Thread.currentThread().getContextClassLoader().getResources("META-INF/jboss-aop.xml");
+            Enumeration en = SecurityActions.getContextClassLoader().getResources("META-INF/jboss-aop.xml");
             while (en.hasMoreElements())
             {
                URL url = (URL) en.nextElement();

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/SecurityActions.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -23,6 +23,7 @@
 
 import java.lang.reflect.AccessibleObject;
 import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -129,4 +130,21 @@
       }
    }
 
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
 }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/advice/AspectFactoryWithClassLoaderSupport.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/advice/AspectFactoryWithClassLoaderSupport.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/advice/AspectFactoryWithClassLoaderSupport.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -83,7 +83,8 @@
       ClassLoader cl = getLoader();
       if (cl == null)
       {
-         ClassLoader tcl = Thread.currentThread().getContextClassLoader(); 
+         // FIXME ClassLoader - which should we always know the correct classloader?
+         ClassLoader tcl = SecurityActions.getContextClassLoader(); 
          if (AspectManager.verbose && logger.isDebugEnabled()) logger.debug("Using context classloader " + tcl + " to load aspect " + name);
          return tcl.loadClass(name);
       }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/advice/DynamicCFlowDefinition.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/advice/DynamicCFlowDefinition.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/advice/DynamicCFlowDefinition.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -61,7 +61,8 @@
       {
          try
          {
-            pClass = Thread.currentThread().getContextClassLoader().loadClass(className);
+            // FIXME ClassLoader - why should the class be visible from the context classloader?
+            pClass = SecurityActions.getContextClassLoader().loadClass(className);
          }
          catch (ClassNotFoundException e)
          {

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/advice/GenericInterceptorFactory.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/advice/GenericInterceptorFactory.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/advice/GenericInterceptorFactory.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -80,7 +80,8 @@
          {
             if (clazz == null)
             {
-               clazz = Thread.currentThread().getContextClassLoader().loadClass(classname);
+               // FIXME ClassLoader - why should the class be visible from the context classloader?
+               clazz = SecurityActions.getContextClassLoader().loadClass(classname);
             }
          }
          Interceptor interceptor = (Interceptor)clazz.newInstance();

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/advice/PerVmAdvice.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/advice/PerVmAdvice.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/advice/PerVmAdvice.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -72,7 +72,7 @@
       if (cl == null)
       {
          //The classloader will be null if loader by the booststrap classloader
-         cl = Thread.currentThread().getContextClassLoader();
+         cl = SecurityActions.getContextClassLoader();
       }
       synchronized (PerVmAdvice.class)
       {

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/advice/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/advice/SecurityActions.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/advice/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -23,6 +23,7 @@
 
 import java.beans.PropertyEditorManager;
 import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -108,5 +109,22 @@
          InitPropertyEditorsAction.PRIVILEGED.initEditors();
       }
    }
-   
+
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
 }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/ByteCodeAnnotationCompiler.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/ByteCodeAnnotationCompiler.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/ByteCodeAnnotationCompiler.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -69,7 +69,7 @@
       JavaDocBuilder builder = new JavaDocBuilder(new AnnotationDocletTagFactory());
       pool = new ClassPool();
       pool.appendSystemPath();
-      pool.appendClassPath(new LoaderClassPath(Thread.currentThread().getContextClassLoader()));
+      pool.appendClassPath(new LoaderClassPath(SecurityActions.getContextClassLoader()));
       for (int i = 0; i < args.length; i++)
       {
          if (args[i].equals("-bytecode"))
@@ -249,7 +249,7 @@
       if (modified)
       {
          String classFile = ctClass.getName().replace('.', '/') + ".class";
-         URL url = Thread.currentThread().getContextClassLoader().getResource(classFile);
+         URL url = SecurityActions.getContextClassLoader().getResource(classFile);
          if (!url.getProtocol().equals("file"))
          {
             throw new RuntimeException(".class file must not be in a jar: " + url.toString());

Added: projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/SecurityActions.java	                        (rev 0)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/annotation/compiler/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -0,0 +1,52 @@
+/*
+* JBoss, Home of Professional Open Source
+* Copyright 2005, JBoss Inc., and individual contributors as indicated
+* by the @authors tag. See the copyright.txt in the distribution for a
+* full listing of individual contributors.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/ 
+package org.jboss.aop.annotation.compiler;
+
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+/**
+ * SecurityActions.
+ * 
+ * @author <a href="adrian at jboss.com">Adrian Brock</a>
+ * @version $Revision: 1.1 $
+ */
+public class SecurityActions
+{
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
+}

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/contrib/IDEClassPoolFactory.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/contrib/IDEClassPoolFactory.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/contrib/IDEClassPoolFactory.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -24,6 +24,8 @@
 import java.io.IOException;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.ArrayList;
 
 import javassist.CannotCompileException;
@@ -95,13 +97,20 @@
       private void loadClasspath()
       {
          childFirstLookup = true;
+         
+         AccessController.doPrivileged(new PrivilegedAction<Object>()
+         {
+            public Object run()
+            {
+               URL urlPaths[] = (URL[]) classPaths.toArray(new URL[classPaths.size()]);
+               loader = new Loader(urlPaths, Thread.currentThread().getContextClassLoader());
+               setClassLoader(loader);
 
-         URL urlPaths[] = (URL[]) classPaths.toArray(new URL[classPaths.size()]);
-         loader = new Loader(urlPaths, Thread.currentThread().getContextClassLoader());
-         setClassLoader(loader);
+               Thread.currentThread().setContextClassLoader(loader);
+               return null;
+            }
+         });
 
-         Thread.currentThread().setContextClassLoader(loader);
-
          classPath = new LoaderClassPath(loader);
          insertClassPath(classPath);
       }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/eclipsesupport/EclipseTestTransformer.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/eclipsesupport/EclipseTestTransformer.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/eclipsesupport/EclipseTestTransformer.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -40,6 +40,7 @@
  * A transformer to weave the main method of the org.eclipse.jdt.internal.junit.runner.RemoteTestRunner, so that we can deploy the correct
  * -aop.xml files before the test case class itself is loaded when running within Eclipse
  *
+ * FIXME SecurityManager - privileged blocks
  * @author <a href="mailto:bill at jboss.org">Bill Burke</a>
  * @version $Revision: 44099 $
  */

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GenerateInstrumentedClassLoader.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GenerateInstrumentedClassLoader.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GenerateInstrumentedClassLoader.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -74,7 +74,7 @@
    {
       ClassPool classpool = ClassPool.getDefault();
       classpool = ClassPool.getDefault();
-      ClassLoader cl = Thread.currentThread().getContextClassLoader();
+      ClassLoader cl = SecurityActions.getContextClassLoader();
       classpool.insertClassPath(new LoaderClassPath(cl));
 
       final CtClass clazz = classpool.get(ClassLoader.class.getName());

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GeneratePluggableInstrumentedClassLoader.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GeneratePluggableInstrumentedClassLoader.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/hook/GeneratePluggableInstrumentedClassLoader.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -73,7 +73,7 @@
    {
       ClassPool classpool = ClassPool.getDefault();
       classpool = ClassPool.getDefault();
-      ClassLoader cl = Thread.currentThread().getContextClassLoader();
+      ClassLoader cl = SecurityActions.getContextClassLoader();
       classpool.insertClassPath(new LoaderClassPath(cl));
 
       final CtClass clazz = classpool.get(ClassLoader.class.getName());

Added: projects/aop/trunk/aop/src/main/org/jboss/aop/hook/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/hook/SecurityActions.java	                        (rev 0)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/hook/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -0,0 +1,52 @@
+/*
+* JBoss, Home of Professional Open Source
+* Copyright 2005, JBoss Inc., and individual contributors as indicated
+* by the @authors tag. See the copyright.txt in the distribution for a
+* full listing of individual contributors.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/ 
+package org.jboss.aop.hook;
+
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+/**
+ * SecurityActions.
+ * 
+ * @author <a href="adrian at jboss.com">Adrian Brock</a>
+ * @version $Revision: 1.1 $
+ */
+public class SecurityActions
+{
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
+}

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/InstrumentorFactory.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/InstrumentorFactory.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/InstrumentorFactory.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -66,7 +66,8 @@
             
             try
             {
-               Class otherInstrumentorClass = Thread.currentThread().getContextClassLoader().loadClass(property);
+               // FIXME ClassLoader - why should the class be visible from the context classloader?
+               Class otherInstrumentorClass = SecurityActions.getContextClassLoader().loadClass(property);
                otherInstrumentorConstructor = otherInstrumentorClass.getConstructor(CONSTRUCTOR_SIG);
                instrumentor = InstrumentorEnum.OTHER_INSTRUMENTOR;
             }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/JoinPointGenerator.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/JoinPointGenerator.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/JoinPointGenerator.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -101,7 +101,7 @@
          {
             THROWS_THROWABLE = new CtClass[]{
                   AspectManager.instance().findClassPool(
-                        Thread.currentThread().getContextClassLoader()).
+                        SecurityActions.getContextClassLoader()).
                         get("java.lang.Throwable")};
          } catch (NotFoundException e)
          {

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/SecurityActions.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -23,9 +23,12 @@
 
 import java.lang.reflect.AccessibleObject;
 import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
+import org.jboss.aop.hook.SecurityActions.GetContextClassLoaderAction;
+
 /**
  * 
  * @author <a href="kabir.khan at jboss.com">Kabir Khan</a>
@@ -78,4 +81,22 @@
          SetAccessibleAction.PRIVILEGED.setAccessible(accessibleObject);
       }
    }
+
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
 }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/TransformerCommon.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/TransformerCommon.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/instrument/TransformerCommon.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -82,7 +82,7 @@
             URLClassLoader loader = Compiler.loader;
             if (loader == null)
             {
-               loader = new URLClassLoader(NO_URLS, Thread.currentThread().getContextClassLoader());
+               loader = new URLClassLoader(NO_URLS, SecurityActions.getContextClassLoader());
             }
             URL url = loader.getResource(
                   classForPackage.getName().replace('.', '/') + ".class");

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/CFlow.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/CFlow.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/CFlow.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -121,6 +121,7 @@
       }
       else
       {
+         // FIXME ClassLoader - why should the class be visible from the context classloader?
          Class clazz = loadClass(element.getClassName());
          
          if (Untransformable.class.isAssignableFrom(clazz))

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/MatcherStrategy.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/MatcherStrategy.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/MatcherStrategy.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -63,7 +63,8 @@
          String sub = instanceOf.getInstanceOfAnnotation().substring(1);
          try
          {
-            Class annotation = Thread.currentThread().getContextClassLoader().loadClass(sub);
+            // FIXME ClassLoader - why should the class be visible from the context classloader? 
+            Class annotation = SecurityActions.getContextClassLoader().loadClass(sub);
             if (AnnotationElement.getAnyAnnotation(clazz, annotation) != null)
             {
                return true;

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/ProxyMatcherStrategy.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/ProxyMatcherStrategy.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/ProxyMatcherStrategy.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -51,6 +51,8 @@
       {
          if (advisor != null)
          {
+            // FIXME ClassLoader - why should the class be visible from the context classloader?
+            ClassLoader cl = SecurityActions.getContextClassLoader();
             ArrayList intros = advisor.getInterfaceIntroductions();
             if (intros.size() > 0)
             {
@@ -62,7 +64,7 @@
                   {
                      for (int i = 0 ; i < introductions.length ; i++)
                      {
-                        Class iface = Thread.currentThread().getContextClassLoader().loadClass(introductions[i]);
+                        Class iface = cl.loadClass(introductions[i]);
                         if (subtypeOf(iface, instanceOf, advisor)) return true;
                      }
                   }
@@ -77,7 +79,7 @@
                         {
                            for (int i = 0 ; i < mixinInterfaces.length ; i++)
                            {
-                              Class iface = Thread.currentThread().getContextClassLoader().loadClass(mixinInterfaces[i]);
+                              Class iface = cl.loadClass(mixinInterfaces[i]);
                               if (subtypeOf(iface, instanceOf, advisor)) return true;                              
                            }
                         }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/SecurityActions.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -22,8 +22,7 @@
 package org.jboss.aop.pointcut;
 
 import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
+import java.security.PrivilegedAction;
 
 /**
  * 
@@ -32,58 +31,33 @@
  */
 class SecurityActions
 {
-
-   interface LoadClassAction
+   static Class loadClass(String name)
    {
-      Class loadClass(String name);
-      
-      LoadClassAction PRIVILEGED = new LoadClassAction()
+      try
       {
-         public Class loadClass(final String name)
-         {
-            try
-            {
-               return (Class)AccessController.doPrivileged(new PrivilegedExceptionAction()
-               {
-                  public Object run() throws Exception
-                  {
-                     return Thread.currentThread().getContextClassLoader().loadClass(name);
-                  }
-               });
-            }
-            catch (PrivilegedActionException e)
-            {
-               throw new RuntimeException(name, e);
-            }
-         }
-      };
-
-      LoadClassAction NON_PRIVILEGED = new LoadClassAction()
+         return getContextClassLoader().loadClass(name);
+      }
+      catch (ClassNotFoundException e)
       {
-         public Class loadClass(final String name)
-         {
-            try
-            {
-               return Thread.currentThread().getContextClassLoader().loadClass(name);
-            }
-            catch (ClassNotFoundException e)
-            {
-               throw new RuntimeException(e);
-            }
-         }
-      };
+         throw new RuntimeException(e);
+      }
    }
    
-   static Class loadClass(String name)
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
    {
-      if (System.getSecurityManager() == null)
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
       {
-         return LoadClassAction.NON_PRIVILEGED.loadClass(name);
+         return Thread.currentThread().getContextClassLoader();
       }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
       else
-      {
-         return LoadClassAction.PRIVILEGED.loadClass(name);
-      }
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
    }
-   
 }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/Util.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/Util.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/pointcut/Util.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -364,6 +364,8 @@
       {
          if (advisor != null)
          {
+            // FIXME ClassLoader - why should the class be visible from the context classloader?
+            ClassLoader cl = SecurityActions.getContextClassLoader();
             ArrayList intros = advisor.getInterfaceIntroductions();
             if (intros.size() > 0)
             {
@@ -375,7 +377,7 @@
                   {
                      for (int i = 0 ; i < introductions.length ; i++)
                      {
-                        Class iface = Thread.currentThread().getContextClassLoader().loadClass(introductions[i]);
+                        Class iface = cl.loadClass(introductions[i]);
                         if (subtypeOf(iface, instanceOf, advisor)) return true;
                      }
                   }
@@ -390,7 +392,7 @@
                         {
                            for (int i = 0 ; i < mixinInterfaces.length ; i++)
                            {
-                              Class iface = Thread.currentThread().getContextClassLoader().loadClass(mixinInterfaces[i]);
+                              Class iface = cl.loadClass(mixinInterfaces[i]);
                               if (subtypeOf(iface, instanceOf, advisor)) return true;                              
                            }
                         }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/MarshalledInterfaceProxy.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/MarshalledInterfaceProxy.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/MarshalledInterfaceProxy.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -58,7 +58,8 @@
    {
       try
       {
-         return ProxyFactory.createInterfaceProxy(guid, Thread.currentThread().getContextClassLoader(), interfaces, mixins, advisor);
+         // FIXME ClassLoader - why should the class(es) be visible from the context classloader?
+         return ProxyFactory.createInterfaceProxy(guid, SecurityActions.getContextClassLoader(), interfaces, mixins, advisor);
       }
       catch (Exception e)
       {

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/SecurityActions.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -23,6 +23,7 @@
 
 import java.lang.reflect.AccessibleObject;
 import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -79,5 +80,22 @@
          SetAccessibleAction.PRIVILEGED.setAccessible(accessibleObject);
       }
    }
+   
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
 
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
 }

Modified: projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/ClassProxyContainer.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/ClassProxyContainer.java	2007-07-26 07:04:43 UTC (rev 64304)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/ClassProxyContainer.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -134,9 +134,10 @@
 
    private void addMethodsFromInterfaces(String[] intf) throws Exception
    {
-      ClassLoader cl = Thread.currentThread().getContextClassLoader();
+      ClassLoader cl = SecurityActions.getContextClassLoader();
       for (int j = 0; intf != null && j < intf.length; ++j)
       {
+         // FIXME ClassLoader - why should the class be visible from the context classloader?
          Class iface = cl.loadClass(intf[j]);
          Method[] ifaceMethods = iface.getMethods();
          for (int k = 0; k < ifaceMethods.length; k++)

Added: projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/SecurityActions.java
===================================================================
--- projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/SecurityActions.java	                        (rev 0)
+++ projects/aop/trunk/aop/src/main/org/jboss/aop/proxy/container/SecurityActions.java	2007-07-26 14:58:14 UTC (rev 64305)
@@ -0,0 +1,53 @@
+/*
+* JBoss, Home of Professional Open Source.
+* Copyright 2006, Red Hat Middleware LLC, and individual contributors
+* as indicated by the @author tags. See the copyright.txt file in the
+* distribution for a full listing of individual contributors. 
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/ 
+package org.jboss.aop.proxy.container;
+
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
+/**
+ * SecurityActions.
+ * 
+ * @author <a href="adrian at jboss.com">Adrian Brock</a>
+ * @version $Revision: 1.1 $
+ */
+class SecurityActions
+{
+   
+   public static class GetContextClassLoaderAction implements PrivilegedAction<ClassLoader>
+   {
+      public static GetContextClassLoaderAction INSTANCE = new GetContextClassLoaderAction();
+      
+      public ClassLoader run()
+      {
+         return Thread.currentThread().getContextClassLoader();
+      }
+   }
+
+   static ClassLoader getContextClassLoader()
+   {
+      if (System.getSecurityManager() == null)
+         return Thread.currentThread().getContextClassLoader();
+      else
+         return AccessController.doPrivileged(GetContextClassLoaderAction.INSTANCE);
+   }
+}




More information about the jboss-cvs-commits mailing list