harmony-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "varun srivastava (JIRA)" <j...@apache.org>
Subject [jira] Created: (HARMONY-6367) Some Methods doesn't have security Permissions check as compared to SUN JDK.
Date Mon, 02 Nov 2009 06:20:59 GMT
Some Methods doesn't have security Permissions check as compared to SUN JDK.
----------------------------------------------------------------------------

                 Key: HARMONY-6367
                 URL: https://issues.apache.org/jira/browse/HARMONY-6367
             Project: Harmony
          Issue Type: Bug
          Components: JDK
         Environment: JDK Security permission checks
            Reporter: varun srivastava
            Priority: Critical
             Fix For: 5.0M11


Following Methods doesn't have security Permissions as compared to SUN JDK.
-----------------------------------------------------------------------------------------------------------------
1) java.net.URL: java.net.URLConnection openConnection(java.net.Proxy) - "checkConnect" missing
in Harmony. Sun perform checkConnect if proxy is present. It checks whether user is allowed
to connect to proxy.

2) java.net.ServerSocket: void implAccept(java.net.Socket) : Harmony missing checkAccept in
protected method. Anyone can create a subclass of SerSocket and accept connections.

3) java.net.SocketPermission: boolean equals(java.lang.Object)  - Harmony use getHostNameInternal
method instead of calling getByName as done in Sun, to retrieve host name of the machine.
Thats why checkConnect is never called before retrieving hostname.

4) java.security.Provider: void load(java.io.InputStream) - Harmony misses checkSecurityAccess("putProviderProperty."
+ name) check

5) java.security.ProtectionDomain: java.lang.String toString() - Harmony doesn't have checkPermission(SecurityConstants.GET_POLICY_PERMISSION)
check in case Policy. isSet for dynamicPerms.

-
Varun Srivastava
UT Austin






-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message