Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Received-SPF: neutral (asf.osuosl.org: local policy)
Message-ID: <438FA555.5060408@debrunners.com>
Date: Thu, 01 Dec 2005 17:37:25 -0800
From: Daniel John Debrunner <djd@debrunners.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.7.3) Gecko/20040910
MIME-Version: 1.0
To: derby-dev@db.apache.org
Subject: Re: [jira] Commented: (DERBY-668) SysInfo can give misleading
 information
 when JDBC jars are loaded from jre/lib/ext
References: <356846996.1133486432942.JavaMail.jira@ajax.apache.org>
In-Reply-To: <356846996.1133486432942.JavaMail.jira@ajax.apache.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Andrew McIntyre (JIRA) wrote:

>     [ http://issues.apache.org/jira/browse/DERBY-668?page=comments#action_12359113 ] 
> 
> Andrew McIntyre commented on DERBY-668:
> ---------------------------------------
> 
> Hi Dan, I was looking at the 1.3.1 javadoc at the time, it's not very specific about the security ramifications of the methods in question. oh well.
> 
> Anyway, if we didn't have permissions to access the class,
> we'd already be in trouble by the time this code was called,
> since we would have already attempted to load the class to pass it
into the getFileWhichLoadedClass method.

No, permission to load the class is not the same as permission to read
the content's of the class file, e.g. analyze its byte code.

I can't (yet) find any supporting documentation that says a ClassLoader
must (should?) not return information for a .class file.

There are a number of Sun/Java bugs on the issue, indicating return a
class file is not a good thing to do.

Dan.