db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Kathey Marsden (JIRA)" <j...@apache.org>
Subject [jira] Commented: (DERBY-4287) call to System.getProperty in BCClass.java is not wrapped in a priv block so may fail when running under SecurityManager
Date Thu, 25 Jun 2009 13:15:07 GMT

    [ https://issues.apache.org/jira/browse/DERBY-4287?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12724081#action_12724081
] 

Kathey Marsden commented on DERBY-4287:
---------------------------------------

Thank you Knut, I think that must be the reason.  If I try with ij and the derby_tests.policy
file with just the property part of the change. I can get an error on creation of the FileOutputStream.
 With the full change the class file is created properly.

This makes me  wonder if in general, liberal permissions in derbyTesting.jar might be masking
security manager issues in the product.





> call to System.getProperty in BCClass.java is not wrapped in a priv block so may fail
when running under SecurityManager
> ------------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-4287
>                 URL: https://issues.apache.org/jira/browse/DERBY-4287
>             Project: Derby
>          Issue Type: Bug
>          Components: Services
>    Affects Versions: 10.1.3.1, 10.2.2.0, 10.3.3.0, 10.4.2.0, 10.5.1.1, 10.6.0.0
>            Reporter: Kathey Marsden
>            Assignee: Kathey Marsden
>            Priority: Minor
>         Attachments: derby-4287_diff.txt
>
>
> I noticed in org.apache.derby.impl.services.bytecode.BCClass.java we have this code:
> 			String systemHome = System.getProperty(Property.SYSTEM_HOME_PROPERTY,".");
> 				writeClassFile(systemHome,false,null);
> which will fail when run under security manager because we have no privilege block.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message