commons-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeremy Lamplough <>
Subject [commons-logging] ClassLoader security problems in LogFactory::getLogFactory()
Date Tue, 08 Jun 2004 04:56:01 GMT
Hi all.

This may be more of a developer question.

I'm attempting to use the commons-logging on a device which has 
restricted security permissions.  (JDK 1.3 and commons-logging version 

The call to LogFactory::getLogFactory() calls getContextClassLoader(). 
This call is returning null, since a security exception is being caught 
in getContextClassLoader() and then ignored by the following code,
        if (e.getTargetException() instanceof SecurityException) {
             ;  // ignore

Since the contextClassLoader is null, all calls to getResourceAsStream 
are then using the method, ClassLoader.getSystemResourceAsStream(name). 
    However thie is always returning null.  Even if the exist, the are never being found.

Also, the System.getProperty() throws an SecurityException.

The result of all this is that I cannot get the file to be read.

However if I modify the LogFactory class so that it uses the 
LogFactory.class.getClassLoader() as the class loader when attempting to 
  read the it works fine.  For example, the 
following modification to the getFactory method correctly finds and 
loads the properties file.  (It just attempts to re-read the resource 
using the LogFactory's loader, if it initially wasn't found.)

*** Mon Mar 31 00:42:36 2003
---      Mon Jun  7 13:46:22 2004
*** 280,285 ****
--- 280,293 ----
           try {
               InputStream stream = 
+             // Jeremy's addition. Due to security restrictions, the
+             // System (default) classloader can not see the properties
+             // file.  However it can be seen using this classes
+             // properties file. Re-attempt to read it.
+             if (stream == null) {
+                 stream = 
+                                              FACTORY_PROPERTIES);
+             }

               if (stream != null) {
                   props = new Properties();

My questions are:
1) Does anyone have a better solution to this problem?
2) Would it be possible to have something like this integrated into the 
code base?  Would it cause problems anywhere else?

I hope my problem and questions are clear.

Thanks you in advance for your help,


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message