tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cos...@locus.apache.org
Subject cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/util/xml XmlMapper.java
Date Thu, 15 Jun 2000 18:51:08 GMT
costin      00/06/15 11:51:07

  Modified:    src/etc  tomcat.policy
               src/share/org/apache/jasper/runtime JspLoader.java
                        JspLoader12.java JspServlet.java
               src/share/org/apache/tomcat/context PolicyInterceptor.java
               src/share/org/apache/tomcat/core Context.java
               src/share/org/apache/tomcat/facade SimpleFacadeManager.java
               src/share/org/apache/tomcat/loader AdaptiveClassLoader.java
                        AdaptiveClassLoader12.java
               src/share/org/apache/tomcat/startup EmbededTomcat.java
               src/share/org/apache/tomcat/util/xml XmlMapper.java
  Removed:     src/share/org/apache/tomcat/loader SetSecurityManager.java
  Log:
  Various changes in policy-based security - it works again ( after 1.1 fixes ).
  
  I tried to make the model as simple as possible - while the original code was much
  more powerfull, it is probably better to keep it simple until we fully understand it.
  
  PolicyInterceptor is the main component - it will replace SetSecurityManager
  and set a SecurityManager when the engine starts ( if none is set ).
  It will also add the minimal permissions to each context, and set the ProtectionDomain.
  
  We'll use only one ProtectionDomain per web-app, and all policy is stored in tomcat.policy.
  ( we do a refresh before loading a new context, so you can edit it after tomcat starts
  and before adding a new webapp - if you don't like the default )
  
  All you need to do is add the PolicyInterceptor in server.xml.
  
  Revision  Changes    Path
  1.5       +5 -44     jakarta-tomcat/src/etc/tomcat.policy
  
  Index: tomcat.policy
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/etc/tomcat.policy,v
  retrieving revision 1.4
  retrieving revision 1.5
  diff -u -r1.4 -r1.5
  --- tomcat.policy	2000/06/15 00:26:41	1.4
  +++ tomcat.policy	2000/06/15 18:49:52	1.5
  @@ -1,12 +1,13 @@
  -// Standard extensions get all permissions by default
  +// Additional permissions for tomcat.
   
  -grant codeBase "file:${java.home}/lib/ext/-" {
  -	permission java.security.AllPermission;
  +// javac
  +grant codeBase "file:${java.home}/../lib/-" {
  +       permission java.security.AllPermission;
   };
   
   // Tomcat gets all permissions
   grant codeBase "file:${tomcat.home}/lib/-" {
  -        permission java.security.AllPermission;
  +       permission java.security.AllPermission;
   };
   
   grant codeBase "file:${tomcat.home}/classes/-" {
  @@ -21,43 +22,3 @@
         permission java.util.PropertyPermission "*", "read";
   };
   
  -// default permissions granted to all domains
  -
  -grant { 
  -	// Allows any thread to stop itself using the java.lang.Thread.stop()
  -	// method that takes no argument.
  -	// Note that this permission is granted by default only to remain
  -	// backwards compatible.
  -	// It is strongly recommended that you either remove this permission
  -	// from this policy file or further restrict it to code sources
  -	// that you specify, because Thread.stop() is potentially unsafe.
  -	// See "http://java.sun.com/notes" for more information.
  -	permission java.lang.RuntimePermission "stopThread";
  -
  -	// allows anyone to listen on un-privileged ports
  -	permission java.net.SocketPermission "localhost:1024-", "listen";
  -
  -	// "standard" properies that can be read by anyone
  -
  -	permission java.util.PropertyPermission "java.version", "read";
  -	permission java.util.PropertyPermission "java.vendor", "read";
  -	permission java.util.PropertyPermission "java.vendor.url", "read";
  -	permission java.util.PropertyPermission "java.class.version", "read";
  -	permission java.util.PropertyPermission "os.name", "read";
  -	permission java.util.PropertyPermission "os.version", "read";
  -	permission java.util.PropertyPermission "os.arch", "read";
  -	permission java.util.PropertyPermission "file.separator", "read";
  -	permission java.util.PropertyPermission "path.separator", "read";
  -	permission java.util.PropertyPermission "line.separator", "read";
  -
  -	permission java.util.PropertyPermission "java.specification.version", "read";
  -	permission java.util.PropertyPermission "java.specification.vendor", "read";
  -	permission java.util.PropertyPermission "java.specification.name", "read";
  -
  -	permission java.util.PropertyPermission "java.vm.specification.version", "read";
  -	permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
  -	permission java.util.PropertyPermission "java.vm.specification.name", "read";
  -	permission java.util.PropertyPermission "java.vm.version", "read";
  -	permission java.util.PropertyPermission "java.vm.vendor", "read";
  -	permission java.util.PropertyPermission "java.vm.name", "read";
  -};
  
  
  
  1.11      +8 -4      jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader.java
  
  Index: JspLoader.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader.java,v
  retrieving revision 1.10
  retrieving revision 1.11
  diff -u -r1.10 -r1.11
  --- JspLoader.java	2000/06/15 00:26:43	1.10
  +++ JspLoader.java	2000/06/15 18:50:06	1.11
  @@ -1,7 +1,7 @@
   /*
  - * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader.java,v
1.10 2000/06/15 00:26:43 costin Exp $
  - * $Revision: 1.10 $
  - * $Date: 2000/06/15 00:26:43 $
  + * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader.java,v
1.11 2000/06/15 18:50:06 costin Exp $
  + * $Revision: 1.11 $
  + * $Date: 2000/06/15 18:50:06 $
    *
    * ====================================================================
    * 
  @@ -105,7 +105,7 @@
   public class JspLoader extends ClassLoader {
       ClassLoader parent;
       Options options;
  -    
  +    Object pd;
   
       /*
        * This should be factoried out
  @@ -123,6 +123,10 @@
   	this.options = options;
       }
   
  +    public void setProtectionDomain( Object pd ) {
  +	this.pd=pd;
  +    }
  +    
       protected synchronized Class loadClass(String name, boolean resolve)
   	throws ClassNotFoundException
       {
  
  
  
  1.2       +1 -1      jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader12.java
  
  Index: JspLoader12.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspLoader12.java,v
  retrieving revision 1.1
  retrieving revision 1.2
  diff -u -r1.1 -r1.2
  --- JspLoader12.java	2000/06/15 00:26:43	1.1
  +++ JspLoader12.java	2000/06/15 18:50:06	1.2
  @@ -100,7 +100,7 @@
       protected  Class defClass(String className, byte[] classData) {
           // If a SecurityManager is being used, set the ProtectionDomain
           // for this clas when it is defined.
  -        Object pd = options.getProtectionDomain();
  +	//	System.out.println("JspLoader12: " + className + " " + pd );
           if( pd != null ) {
   	    return defineClass(className, classData, 0,
   			       classData.length,
  
  
  
  1.26      +5 -2      jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java
  
  Index: JspServlet.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/jasper/runtime/JspServlet.java,v
  retrieving revision 1.25
  retrieving revision 1.26
  diff -u -r1.25 -r1.26
  --- JspServlet.java	2000/06/15 00:26:43	1.25
  +++ JspServlet.java	2000/06/15 18:50:07	1.26
  @@ -254,6 +254,8 @@
   
   	    loader.setParentClassLoader(parentClassLoader);
   	    loader.setOptions(options);
  +	    Object pd=context.getAttribute("org.apache.tomcat.protection_domain");
  +	    loader.setProtectionDomain( pd );
   	}
   	if (firstTime) {
   	    firstTime = false;
  @@ -463,9 +465,10 @@
           } catch (JasperException ex) {
               throw ex;
           } catch (Exception ex) {
  -            throw new JasperException(Constants.getString("jsp.error.unable.compile"),
  +	    ex.printStackTrace();
  +	    throw new JasperException(Constants.getString("jsp.error.unable.compile"),
                                         ex);
  -        }
  +	}
   
   	// Reload only if it's outdated
   	if((jspClass == null) || outDated) {
  
  
  
  1.2       +40 -9     jakarta-tomcat/src/share/org/apache/tomcat/context/PolicyInterceptor.java
  
  Index: PolicyInterceptor.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/context/PolicyInterceptor.java,v
  retrieving revision 1.1
  retrieving revision 1.2
  diff -u -r1.1 -r1.2
  --- PolicyInterceptor.java	2000/06/10 17:54:24	1.1
  +++ PolicyInterceptor.java	2000/06/15 18:50:14	1.2
  @@ -83,28 +83,58 @@
    * @author costin@dnt.ro
    */
   public class PolicyInterceptor extends BaseInterceptor {
  -
  +    String securityManagerClass="java.lang.SecurityManager";
  +    String policyFile=null;
  +    
       public PolicyInterceptor() {
       }
   
  -    /** Add a default set of permissions to the context
  +    public void setSecurityManagerClass(String cls) {
  +	securityManagerClass=cls;
  +    }
  +
  +    public void setPolicyFile( String pf) {
  +	policyFile=pf;
  +    }
  +    
  +    /** Set the security manager, so that policy will be used
        */
  -    protected void addDefaultPermissions( Context context, Permissions p ) {
  -        String base = context.getDocBase();
  +    public void engineInit(ContextManager cm) throws TomcatException {
  +	if( System.getSecurityManager() != null ) return;
  +	try {
  +	    Class c=Class.forName(securityManagerClass);
  +	    Object o=c.newInstance();
  +	    System.setSecurityManager((SecurityManager)o);
  +	    // 	    System.out.println("Security Manager set to " +
  +	    // 			       securityManagerClass);
  +	} catch( ClassNotFoundException ex ) {
  +	    System.out.println("SecurityManager Class not found: " +
  +			       securityManagerClass);
  +	} catch( Exception ex ) {
  +            System.out.println("SecurityManager Class could not be loaded: " +
  +			       securityManagerClass);
  +	}
  +    }
   
  +    
  +    /** Add a default set of permissions to the context
  +     */
  +    protected void addDefaultPermissions( Context context,String base,
  +					  Permissions p )
  +    {
   	// Add default read "-" FilePermission for docBase, classes, lib
   	// Default per context permissions
  -	FilePermission fp = new FilePermission(base + "-", "read");
  +	FilePermission fp = new FilePermission(base + "/-", "read");
   	if( fp != null )
   	    p.add((Permission)fp);
  -
  +	
       }
       
       public void contextInit( Context context)
   	throws TomcatException
       {
  -	SecurityManager sm = System.getSecurityManager();
  -	if( sm==null ) return;
  +	//	SecurityManager sm = System.getSecurityManager();
  +	//	if( sm==null ) return;
   
   	ContextManager cm = context.getContextManager();
   	String base = context.getDocBase();
  @@ -132,10 +162,11 @@
   		}
   	    }
   	    
  -	    addDefaultPermissions( context, p);
  +	    addDefaultPermissions( context, dir.getAbsolutePath(), p);
   	
   	    /** Add whatever permissions are specified in the policy file
   	     */
  +	    Policy.getPolicy().refresh();
   	    PermissionCollection pFileP=Policy.getPolicy().getPermissions(cs);
   	    if( pFileP!= null ) {
   		Enumeration enum=pFileP.elements();
  
  
  
  1.94      +1 -1      jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java
  
  Index: Context.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/core/Context.java,v
  retrieving revision 1.93
  retrieving revision 1.94
  diff -u -r1.93 -r1.94
  --- Context.java	2000/06/15 00:26:45	1.93
  +++ Context.java	2000/06/15 18:50:18	1.94
  @@ -376,7 +376,7 @@
   		String cp= getServletLoader().getClassPath();
   		return cp;
   	    }
  -	    if( name.equals( Constants.ATTRIB_JSP_ProtectionDomain) ) {
  +	    if( name.equals( "org.apache.tomcat.protection_domain") ) {
   		return getProtectionDomain();
   	    }
   	    if(name.equals("org.apache.tomcat.classloader")) {
  
  
  
  1.3       +12 -12    jakarta-tomcat/src/share/org/apache/tomcat/facade/SimpleFacadeManager.java
  
  Index: SimpleFacadeManager.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/facade/SimpleFacadeManager.java,v
  retrieving revision 1.2
  retrieving revision 1.3
  diff -u -r1.2 -r1.3
  --- SimpleFacadeManager.java	2000/05/30 15:40:10	1.2
  +++ SimpleFacadeManager.java	2000/06/15 18:50:38	1.3
  @@ -99,24 +99,24 @@
       }
   
       public ServletContext createServletContextFacade(Context ctx) {
  -	if( ctx != this.ctx ) return null; // throw
  +	//if( ctx != this.ctx ) return null; // throw
   	return new ServletContextFacade(ctx.getContextManager() , ctx);
       }
   
       public HttpServletRequest createHttpServletRequestFacade(Request req) {
   	Context reqCtx=req.getContext();
  -	if( reqCtx != ctx && reqCtx != null ) return null; // throw
  +	//	if( reqCtx != ctx && reqCtx != null ) return null; // throw
   	return new HttpServletRequestFacade(req);
       }
   
       public HttpServletResponse createHttpServletResponseFacade(Response res) {
   	Context resCtx=res.getRequest().getContext();
  -	if( resCtx != ctx && resCtx != null ) return null; // throw
  +	//if( resCtx != ctx && resCtx != null ) return null; // throw
   	return new HttpServletResponseFacade(res);
       }
   
       public void recycle( Request rreq ) {
  -	if( rreq.getContext() != ctx ) return; // throw
  +	//if( rreq.getContext() != ctx ) return; // throw
   	
   	HttpServletRequest req=rreq.getFacade();
   	if( ! (req instanceof HttpServletRequestFacade))
  @@ -146,24 +146,24 @@
   	    // A user can't create HttpServletRequest objects ( I hope )
   	    return rreq;
   	}
  -	if( rreq.getContext() != ctx ) {
  -	    System.out.println("XXX " + ctx.getPath() + " " + rreq.getContext() + " " + rreq);
  -	    ctx.log( "Attempt to get the real request from wrong context");
  -	    /*DEBUG*/ try {throw new Exception(); } catch(Exception ex) {ex.printStackTrace();}
  -	    return null;
  -	}
  +	// 	if( rreq.getContext() != ctx ) {
  +	// 	    System.out.println("XXX " + ctx.getPath() + " " + rreq.getContext() + " " + rreq);
  +	// 	    ctx.log( "Attempt to get the real request from wrong context");
  +	// 	    /*DEBUG*/ try {throw new Exception(); } catch(Exception ex) {ex.printStackTrace();}
  +	// 	    return null;
  +	// 	}
   	return rreq;
       }
   
       public Context getRealContext( ServletContext sctx ) {
   	Context realSctx=((ServletContextFacade)sctx).getRealContext();
  -	if( realSctx != ctx ) return null;
  +	//	if( realSctx != ctx ) return null;
   	return realSctx;
       }
   
   
       public ServletConfig createServletConfig(ServletWrapper sw) {
  -	if( sw.getContext() != ctx ) return null;
  +	//	if( sw.getContext() != ctx ) return null;
   	return new ServletConfigImpl(sw);
       }
   
  
  
  
  1.8       +9 -6      jakarta-tomcat/src/share/org/apache/tomcat/loader/AdaptiveClassLoader.java
  
  Index: AdaptiveClassLoader.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/loader/AdaptiveClassLoader.java,v
  retrieving revision 1.7
  retrieving revision 1.8
  diff -u -r1.7 -r1.8
  --- AdaptiveClassLoader.java	2000/06/15 00:26:47	1.7
  +++ AdaptiveClassLoader.java	2000/06/15 18:50:43	1.8
  @@ -118,7 +118,7 @@
    * @author Martin Pool
    * @author Jim Heintz
    * @author <a href="mailto:stefano@apache.org">Stefano Mazzocchi</a>
  - * @version $Revision: 1.7 $ $Date: 2000/06/15 00:26:47 $
  + * @version $Revision: 1.8 $ $Date: 2000/06/15 18:50:43 $
    * @see java.lang.ClassLoader
    */
   public class AdaptiveClassLoader extends ClassLoader {
  @@ -263,10 +263,10 @@
           }
   
          // Install the SecurityManager if not already installed
  -       if( generationCounter == 0 && sm == null ) {
  -           sm = System.getSecurityManager();
  -	   //	   System.out.println("XXX AdaptiveClassLoader: " + sm );
  -       }
  +	//        if( generationCounter == 0 && sm == null ) {
  +	//            sm = System.getSecurityManager();
  +	// 	   //	   System.out.println("XXX AdaptiveClassLoader: " + sm );
  +	//        }
   
           // Store the class repository for use
           this.repository = classRepository;
  @@ -319,8 +319,11 @@
        * @param className The name of the class to check for modification.
        */
       public synchronized boolean shouldReload(String classname) {
  +	return checkExpired( classname );
  +    }
   
  -        ClassCacheEntry entry = (ClassCacheEntry) cache.get(classname);
  +    protected boolean checkExpired(String classname ) {
  +	ClassCacheEntry entry = (ClassCacheEntry) cache.get(classname);
   
           if (entry == null) {
               // class wasn't even loaded
  
  
  
  1.2       +20 -6     jakarta-tomcat/src/share/org/apache/tomcat/loader/AdaptiveClassLoader12.java
  
  Index: AdaptiveClassLoader12.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/loader/AdaptiveClassLoader12.java,v
  retrieving revision 1.1
  retrieving revision 1.2
  diff -u -r1.1 -r1.2
  --- AdaptiveClassLoader12.java	2000/06/15 00:26:47	1.1
  +++ AdaptiveClassLoader12.java	2000/06/15 18:50:45	1.2
  @@ -81,12 +81,26 @@
   
       protected Class doDefineClass(String name, byte classData[], Object pd )
       {
  -	if( sm != null ) {
  -	    return defineClass(name, classData, 0, classData.length,
  -			       (ProtectionDomain)pd);
  -	} else {
  -	    return  defineClass(name, classData, 0, classData.length);
  -	}
  +	//	System.out.println("XXX defineClass12 " + pd );
  +	// 	if( sm != null ) {
  +	return defineClass(name, classData, 0, classData.length,
  +			   (ProtectionDomain)pd);
  +	// } else {
  +	// 	    return  defineClass(name, classData, 0, classData.length);
  +	// 	}
  +    }
  +
  +    public boolean shouldReload( String classname ) {
  +	final String classnameF=classname;
  +	Boolean b = (Boolean)AccessController.doPrivileged(new
  +	    PrivilegedAction() {
  +		public Object run() 
  +		{
  +		    return new Boolean( checkExpired( classnameF ));
  +		} 
  +	    });
  +	return b.booleanValue();
  +
       }
   
   }
  
  
  
  1.3       +1 -1      jakarta-tomcat/src/share/org/apache/tomcat/startup/EmbededTomcat.java
  
  Index: EmbededTomcat.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/startup/EmbededTomcat.java,v
  retrieving revision 1.2
  retrieving revision 1.3
  diff -u -r1.2 -r1.3
  --- EmbededTomcat.java	2000/06/14 19:07:23	1.2
  +++ EmbededTomcat.java	2000/06/15 18:51:01	1.3
  @@ -50,7 +50,7 @@
       String workDir;
       
       // configurable properties
  -    int debug=0;
  +    int debug=21;
       
       public EmbededTomcat() {
       }
  
  
  
  1.24      +1 -0      jakarta-tomcat/src/share/org/apache/tomcat/util/xml/XmlMapper.java
  
  Index: XmlMapper.java
  ===================================================================
  RCS file: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/util/xml/XmlMapper.java,v
  retrieving revision 1.23
  retrieving revision 1.24
  diff -u -r1.23 -r1.24
  --- XmlMapper.java	2000/06/13 00:32:42	1.23
  +++ XmlMapper.java	2000/06/15 18:51:06	1.24
  @@ -437,6 +437,7 @@
   	    if( is!= null )
   		return new InputSource(is);
   	    System.out.println("XXX resource not found !!! " + dtd);
  +	    System.out.println(this.getClass().getClassLoader().getClass().getName());
   	}
   	
   	log("Can't find resource for entity: " + publicId + " --> " + systemId + " \"" + dtd
+"\"");
  
  
  

Mime
View raw message