commons-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeremy Lamplough <jere...@research.canon.com.au>
Subject [commons-logging] ClassLoader security problems in LogFactory::getLogFactory()
Date Tue, 08 Jun 2004 04:56:01 GMT
Hi all.

This may be more of a developer question.

I'm attempting to use the commons-logging on a device which has 
restricted security permissions.  (JDK 1.3 and commons-logging version 
1.0.3).

The call to LogFactory::getLogFactory() calls getContextClassLoader(). 
This call is returning null, since a security exception is being caught 
in getContextClassLoader() and then ignored by the following code,
        if (e.getTargetException() instanceof SecurityException) {
             ;  // ignore
        }

Since the contextClassLoader is null, all calls to getResourceAsStream 
are then using the method, ClassLoader.getSystemResourceAsStream(name). 
    However thie is always returning null.  Even if the 
commons-logging.properties exist, the are never being found.

Also, the System.getProperty() throws an SecurityException.

The result of all this is that I cannot get the 
commons-logging.properties file to be read.


However if I modify the LogFactory class so that it uses the 
LogFactory.class.getClassLoader() as the class loader when attempting to 
  read the commons-logging.properties it works fine.  For example, the 
following modification to the getFactory method correctly finds and 
loads the properties file.  (It just attempts to re-read the resource 
using the LogFactory's loader, if it initially wasn't found.)

*** LogFactory.java Mon Mar 31 00:42:36 2003
--- LogFactory.java      Mon Jun  7 13:46:22 2004
***************
*** 280,285 ****
--- 280,293 ----
           try {
               InputStream stream = 
getResourceAsStream(contextClassLoader,
                                                        FACTORY_PROPERTIES);
+             // Jeremy's addition. Due to security restrictions, the
+             // System (default) classloader can not see the properties
+             // file.  However it can be seen using this classes
+             // properties file. Re-attempt to read it.
+             if (stream == null) {
+                 stream = 
getResourceAsStream(LogFactory.class.getClassLoader(),
+                                              FACTORY_PROPERTIES);
+             }

               if (stream != null) {
                   props = new Properties();


My questions are:
1) Does anyone have a better solution to this problem?
2) Would it be possible to have something like this integrated into the 
code base?  Would it cause problems anywhere else?


I hope my problem and questions are clear.

Thanks you in advance for your help,

Jeremy




---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org


Mime
View raw message