Mailing-List: contact jdo-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jdo-dev@db.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
From: Andy Jefferson <andy@datanucleus.org>
To: jdo-dev@db.apache.org
Subject: Re: Security issue with generated classes
Date: Mon, 28 Jul 2008 07:17:50 +0100
User-Agent: KMail/1.9.6
Cc: JDO Expert Group <jdo-experts-ext@sun.com>
References: <8A147C4A-37EA-4327-A218-B9C86B4F31BD@SUN.com>
 <5120459C-B135-4EF9-9895-AFF987A20851@SUN.com>
 <1BC112B6-B3BC-4149-8F68-C3DA8E31CD18@SUN.com>
In-Reply-To: <1BC112B6-B3BC-4149-8F68-C3DA8E31CD18@SUN.com>
Organization: DataNucleus
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Message-Id: <200807280717.50638.andy@datanucleus.org>

Hi Craig,

> I looked at the datanucleus implementation and found that I'm totally
> not qualified to propose a patch. I found the code that needs to be
> changed in org/datanucleus/enhancer/bcel/method/
> JdoReplaceStateManager.java and org/datanucleus/enhancer/asm/method/
> JdoReplaceStateManager.java but that's as far as I could get without
> knowing asm, bcel, and byte-codes.

The ASM-based enhancer is now updated to match the current spec.

The BCEL-based enhancer is not updated since strategic direction is using ASM  
(and the TCK uses ASM). There's a DataNucleus JIRA and a TODO for  
implementing using BCEL if anyone has the time/motivation.

The original code for that method was written for JDO 1.0.0 and never changed  
since seemingly.


-- 
Andy  (DataNucleus - http://www.datanucleus.org)