Return-Path: Delivered-To: apmail-tomcat-dev-archive@www.apache.org Received: (qmail 76426 invoked from network); 23 Jan 2008 07:51:12 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 23 Jan 2008 07:51:12 -0000 Received: (qmail 45399 invoked by uid 500); 23 Jan 2008 07:50:59 -0000 Delivered-To: apmail-tomcat-dev-archive@tomcat.apache.org Received: (qmail 45352 invoked by uid 500); 23 Jan 2008 07:50:59 -0000 Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Tomcat Developers List" Delivered-To: mailing list dev@tomcat.apache.org Received: (qmail 45341 invoked by uid 500); 23 Jan 2008 07:50:59 -0000 Delivered-To: apmail-jakarta-tomcat-dev@jakarta.apache.org Received: (qmail 45338 invoked by uid 99); 23 Jan 2008 07:50:59 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 22 Jan 2008 23:50:59 -0800 X-ASF-Spam-Status: No, hits=-100.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO brutus.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 23 Jan 2008 07:50:41 +0000 Received: by brutus.apache.org (Postfix, from userid 33) id B5A6D714208; Tue, 22 Jan 2008 23:50:47 -0800 (PST) From: bugzilla@apache.org To: tomcat-dev@jakarta.apache.org Subject: DO NOT REPLY [Bug 44282] New: - WebappClassLoader.findClass calls getClassLoader without privileges Message-ID: X-Bugzilla-Reason: AssignedTo Date: Tue, 22 Jan 2008 23:50:47 -0800 (PST) X-Virus-Checked: Checked by ClamAV on apache.org DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG� RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT . ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND� INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=44282 Summary: WebappClassLoader.findClass calls getClassLoader without privileges Product: Tomcat 5 Version: 5.5.25 Platform: Other OS/Version: Linux Status: NEW Severity: minor Priority: P4 Component: Catalina AssignedTo: tomcat-dev@jakarta.apache.org ReportedBy: ecapachedev@gmail.com When logging is in TRACE mode or lower, org.apache.catalina.loader.WebappClassLoader.findClass(String) calls getClassLoader() without a privileged block. With security enabled, this will cause a SecurityException if the RuntimePermission to getClassLoader is not granted. -- Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org For additional commands, e-mail: dev-help@tomcat.apache.org