[jboss-jira] [JBoss JIRA] (WFLY-13588) Messaging should not expose its subsystem module to deployments

[Paul Ferraro (Jira)]

     [ https://issues.redhat.com/browse/WFLY-13588?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Paul Ferraro updated WFLY-13588:
--------------------------------
    Description: 
The messaging-activemq subsystem exposes its subsystem module to the deployment classloader.  According to comments, this was done to allow CDI to load the requisite portable extension to support JMSContext injection.  This is a very bad idea, as the deployment can then access all of the subsystem internals.

The correct way to do this is to create a separate module containing the CDI extension and its dependents and only expose this module to deployments.

  was:
The messaging-activemq subsystem exposes its subsystem module to the deployment classloader.  According to comments, this was done to allow CDI to load the requisite portable extension to support JMSContext injection.

The correct way to do this is to create a separate module containing the CDI extension and its dependents and only expose this module to deployments.



> Messaging should not expose its subsystem module to deployments
> ---------------------------------------------------------------
>
>                 Key: WFLY-13588
>                 URL: https://issues.redhat.com/browse/WFLY-13588
>             Project: WildFly
>          Issue Type: Bug
>          Components: JMS
>    Affects Versions: 20.0.0.Final
>            Reporter: Paul Ferraro
>            Assignee: Paul Ferraro
>            Priority: Major
>
> The messaging-activemq subsystem exposes its subsystem module to the deployment classloader.  According to comments, this was done to allow CDI to load the requisite portable extension to support JMSContext injection.  This is a very bad idea, as the deployment can then access all of the subsystem internals.
> The correct way to do this is to create a separate module containing the CDI extension and its dependents and only expose this module to deployments.



--
This message was sent by Atlassian Jira
(v7.13.8#713008)