tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ed Korthof>
Subject Re: classloader issues (ClassCastException on org.xml.sax.Parser)
Date Wed, 23 Jan 2002 02:55:22 GMT
On Tue, Jan 22, 2002 at 06:14:18PM -0800, Remy Maucherat wrote:
> > Hi --
> >
> > I think the fundamental problem is a bad specification (allowing people
> > to override some classes in a child classloader -- and trying to prevent
> > them from loading others -- is just silly); but it could be improved in
> > tomcat in a couple of ways.  I haven't yet tested this, but I think you
> > would have *far* better protection from bad .jar files if you moved
> > those security checks (which are currently used to disable .jar files
> > entirely -- IMO, that's wrong) into loadClass -- and change them so that
> > they check the class name against a list of packages, rather than just
> > looking for a few specific packages.
> Unfortunately, you can't do that, since JSP uses javac to compile the pages.
> javac accesses JARs as a whole, so either you have to filter out the whole
> JAR or you allow Jasper to load all the classes it contains, which will make
> JSPs behave differently from servlets (bad).
> It's a complex issue, so I really don't know what to do ...

Do you mean you're spawning another process to do compilation?  I
thought that javac's core class had been fixed so that it'd be possible
to run it in a thread in an existing server ... for a number of reasons,
including performance and the awkwardness of spawning processes on
win32.  (I know there was talk about that years ago, when I last worked
on a page compilation system, but I don't know what happened with it.)

I think it would be hard to avoid having javac work different from
servlets if it runs in a separate process and it doesn't use a
classloader like the webapp classloader -- unless you change the order
of the jar files iff delegate is set to false.  (AFAICT
WebappClassloader will delegate to the parent classloader regardless --
the question is just if it does so before or after looking at the local
repositories, which is what setDelegate toggles.)  Is this being done?

thanks --


To unsubscribe, e-mail:   <>
For additional commands, e-mail: <>

View raw message