[jboss-cvs] JBossAS SVN: r96770 - in trunk: tomcat/src/resources and 1 other directory.

[jboss-cvs-commits at lists.jboss.org]

Author: remy.maucherat at jboss.com
Date: 2009-11-23 20:24:54 -0500 (Mon, 23 Nov 2009)
New Revision: 96770

Modified:
   trunk/server/src/main/java/org/jboss/web/deployers/ServletContainerInitializerDeployer.java
   trunk/tomcat/src/resources/war-deployers-jboss-beans.xml
Log:
- Add a more secure option to restrict SCI scanning to certain JARs (remove to scan all classpath using ServiceLoader).

Modified: trunk/server/src/main/java/org/jboss/web/deployers/ServletContainerInitializerDeployer.java
===================================================================
--- trunk/server/src/main/java/org/jboss/web/deployers/ServletContainerInitializerDeployer.java	2009-11-24 00:09:41 UTC (rev 96769)
+++ trunk/server/src/main/java/org/jboss/web/deployers/ServletContainerInitializerDeployer.java	2009-11-24 01:24:54 UTC (rev 96770)
@@ -25,6 +25,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.net.URL;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -41,6 +42,7 @@
 import org.jboss.deployers.structure.spi.DeploymentUnit;
 import org.jboss.deployers.vfs.spi.structure.VFSDeploymentUnit;
 import org.jboss.metadata.web.spec.WebMetaData;
+import org.jboss.virtual.VFS;
 import org.jboss.virtual.VirtualFile;
 
 /**
@@ -53,7 +55,19 @@
 {
    public static final String SCI_ATTACHMENT_NAME = "sci."+WebMetaData.class.getName();
    public static final String SCI_HANDLESTYPES_ATTACHMENT_NAME = "sci.handlestypes."+WebMetaData.class.getName();
-  
+
+   private List<URL> sciJars = null;
+
+   public List<URL> getSciJars()
+   {
+      return sciJars;
+   }
+
+   public void setSciJars(List<URL> sciJars)
+   {
+      this.sciJars = sciJars;
+   }
+
    /**
     * Create the SCI information.
     */
@@ -75,12 +89,38 @@
       }
       Set<ServletContainerInitializer> scis = new HashSet<ServletContainerInitializer>();
       // Load the shared ServletContainerInitializer services
-      ServiceLoader<ServletContainerInitializer> serviceLoader = 
-         ServiceLoader.load(ServletContainerInitializer.class, this.getClass().getClassLoader());
-      for (ServletContainerInitializer service : serviceLoader)
+      if (sciJars == null)
       {
-         scis.add(service);
+         ServiceLoader<ServletContainerInitializer> serviceLoader = 
+            ServiceLoader.load(ServletContainerInitializer.class, this.getClass().getClassLoader());
+         for (ServletContainerInitializer service : serviceLoader)
+         {
+            scis.add(service);
+         }
       }
+      else
+      {
+         for (URL jarURL : sciJars)
+         {
+            try
+            {
+               VFS vfs = VFS.getVFS(jarURL);
+               VirtualFile sci = vfs.getChild("META-INF/services/javax.servlet.ServletContainerInitializer");
+               if (sci != null)
+               {
+                  ServletContainerInitializer service = loadSci(unit, sci, jarURL.getPath());
+                  if (service != null)
+                  {
+                     scis.add(service);
+                  }
+               }
+            }
+            catch (Exception e)
+            {
+               DeploymentException.rethrowAsDeploymentException("Deployment error scanning shared SCIs for JAR: " + jarURL.getPath(), e);
+            }
+         }
+      }
       // Find local ServletContainerInitializer services
       List<String> order = 
          (List<String>) unit.getAttachment(MergedJBossWebMetaDataDeployer.WEB_ORDER_ATTACHMENT_NAME);
@@ -93,40 +133,11 @@
             VirtualFile sci = localScis.get(jar);
             if (sci != null)
             {
-               InputStream is = null;
-               try
+               ServletContainerInitializer service = loadSci(unit, sci, jar);
+               if (service != null)
                {
-                  // Get the ServletContainerInitializer class name
-                  is = sci.openStream();
-                  BufferedReader reader = new BufferedReader(new InputStreamReader(is));
-                  String servletContainerInitializerClassName = reader.readLine();
-                  int pos = servletContainerInitializerClassName.indexOf('#');
-                  if (pos > 0) {
-                     servletContainerInitializerClassName = servletContainerInitializerClassName.substring(0, pos);
-                  }
-                  servletContainerInitializerClassName = servletContainerInitializerClassName.trim();
-                  // Instantiate the ServletContainerInitializer
-                  ServletContainerInitializer service = 
-                     (ServletContainerInitializer) unit.getClassLoader()
-                     .loadClass(servletContainerInitializerClassName).newInstance();
                   scis.add(service);
                }
-               catch (Exception e)
-               {
-                  DeploymentException.rethrowAsDeploymentException("Deployment error processing SCI for JAR: " + jar, e);
-               }
-               finally
-               {
-                  try
-                  {
-                     if (is != null)
-                        is.close();
-                  }
-                  catch (IOException e)
-                  {
-                     ;
-                  }
-               }
             }
          }
       }
@@ -182,5 +193,44 @@
       unit.addAttachment(SCI_ATTACHMENT_NAME, scis);
       unit.addAttachment(SCI_HANDLESTYPES_ATTACHMENT_NAME, handlesTypes);
   }
+   
+   
+   private ServletContainerInitializer loadSci(DeploymentUnit unit, VirtualFile sci, String jar) throws DeploymentException
+   {
+      ServletContainerInitializer service = null;
+      InputStream is = null;
+      try
+      {
+         // Get the ServletContainerInitializer class name
+         is = sci.openStream();
+         BufferedReader reader = new BufferedReader(new InputStreamReader(is));
+         String servletContainerInitializerClassName = reader.readLine();
+         int pos = servletContainerInitializerClassName.indexOf('#');
+         if (pos > 0) {
+            servletContainerInitializerClassName = servletContainerInitializerClassName.substring(0, pos);
+         }
+         servletContainerInitializerClassName = servletContainerInitializerClassName.trim();
+         // Instantiate the ServletContainerInitializer
+         service = (ServletContainerInitializer) unit.getClassLoader()
+            .loadClass(servletContainerInitializerClassName).newInstance();
+      }
+      catch (Exception e)
+      {
+         DeploymentException.rethrowAsDeploymentException("Deployment error processing SCI for JAR: " + jar, e);
+      }
+      finally
+      {
+         try
+         {
+            if (is != null)
+               is.close();
+         }
+         catch (IOException e)
+         {
+            ;
+         }
+      }
+      return service;
+   }
 
 }

Modified: trunk/tomcat/src/resources/war-deployers-jboss-beans.xml
===================================================================
--- trunk/tomcat/src/resources/war-deployers-jboss-beans.xml	2009-11-24 00:09:41 UTC (rev 96769)
+++ trunk/tomcat/src/resources/war-deployers-jboss-beans.xml	2009-11-24 01:24:54 UTC (rev 96770)
@@ -31,6 +31,12 @@
       <property name="relativeOrder">2003</property>
    </bean>
    <bean name="ServletContainerInitializerDeployer" class="org.jboss.web.deployers.ServletContainerInitializerDeployer">
+      <!-- JARs containing SCIs -->
+      <property name="sciJars">
+         <list class="java.util.ArrayList" elementClass="java.net.URL">
+            <value>${jboss.server.home.url}${/}deploy${/}jbossweb.sar${/}jsf-libs${/}jsf-impl.jar</value>
+         </list>         
+      </property>
    </bean>
    <!-- Servlet 3.0 annotation support (performance drop) -->
    <bean name="WebAnnotationMetaDataDeployer" class="org.jboss.web.deployers.WarAnnotationMetaDataDeployer">