[jboss-dev-forums] [Design of POJO Server] - Re: ProfileService equiv to ServiceBindingManager

[adrian@jboss.org]

"bstansberry at jboss.com" wrote : 
  | 
  |   |   <attribute name="Foo">
  |   |       <value-factory bean="FooProvider" method="getFoo" default="1100">
  |   |           <parameter class="com.foo.Bar">A</parameter>
  |   |           <parameter class="java.lang.Integer">1</parameter>
  |   |       </value-factory>
  |   |    </attribute>
  |   | 
  | 
  | (I don't see a clear way to get FooProvider's classloader from a KernelControllerContext, so if com.foo.Bar is not visible, above won't work).
  | 

Why would you want it to use FooProvider's classloader?

If com.foo.Bar is not visible to Foo then its got no right trying
to call the method.

In fact, it would be a potential security hole for us to switch the classloader
because the deployer of Foo could get access to a classloader/classes
he doesn't have rights to, just by deploying some xml with a value-factory. :-)


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4167715#4167715

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4167715