[jboss-jira] [JBoss JIRA] (AS7-6316) Review of AccessController and PrivilegedAction use across AS7

[Darran Lofthouse (JIRA)]

     [ https://issues.jboss.org/browse/AS7-6316?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Darran Lofthouse updated AS7-6316:
----------------------------------

    Description: 
The following needs reviewing across AS7: -
 - On demand instantiation of PrivilegedActions where singletons would suffice (Consider frequency of calls, gc may be preferable).
 - Use of AccessController even though there is no SecurityManager set.
 - Code duplication, in every case I have seen so far the code is the same regardless of if PRIVILEGED or NON_PRIVILEGED
 - Utility methods with visibility too high.
 - In depth review of the other methods, i.e. if the first thing a public method does is set the class loader based on a parameter passed in it could be used badly - it may even be a justification for that method to NOT use a PrivilegedAction.
 - Code that requires to be executed using a PrivilegedAction should also be double checked that it is not doing too much as the identity of the caller.



  was:
The following needs reviewing across AS7: -
 - On demand instantiation of PrivilegedActions where singletons would suffice (Consider frequency of calls, gc may be preferable).
 - Use of AccessController even though there is no SecurityManager set.
 - Code duplication, in every case I have seen so far the code is the same regardless of if PRIVILEGED or NON_PRIVILEGED
 - Utility methods with visibility too high.
 - In depth review of the other methods, i.e. if the first thing a public method does is set the class loader based on a parameter passed in it could be used badly - it may even be a justification for that method to NOT use a PrivilegedAction.



    
> Review of AccessController and PrivilegedAction use across AS7
> --------------------------------------------------------------
>
>                 Key: AS7-6316
>                 URL: https://issues.jboss.org/browse/AS7-6316
>             Project: Application Server 7
>          Issue Type: Task
>          Components: Security
>            Reporter: Darran Lofthouse
>            Assignee: Darran Lofthouse
>            Priority: Critical
>             Fix For: 7.2.0.Alpha1
>
>
> The following needs reviewing across AS7: -
>  - On demand instantiation of PrivilegedActions where singletons would suffice (Consider frequency of calls, gc may be preferable).
>  - Use of AccessController even though there is no SecurityManager set.
>  - Code duplication, in every case I have seen so far the code is the same regardless of if PRIVILEGED or NON_PRIVILEGED
>  - Utility methods with visibility too high.
>  - In depth review of the other methods, i.e. if the first thing a public method does is set the class loader based on a parameter passed in it could be used badly - it may even be a justification for that method to NOT use a PrivilegedAction.
>  - Code that requires to be executed using a PrivilegedAction should also be double checked that it is not doing too much as the identity of the caller.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira