You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@commons.apache.org by Daryl Stultz <da...@6degrees.com> on 2003/09/12 22:54:18 UTC
Jelly: and security
Hi folks,
Suppose I build a SOAP service that runs Jelly scripts (i.e. the client
calls the service/method and passes in the Jelly script to be executed). I
want the client to be able to use core Jelly tags but I don't want them to
do things like:
<j:new className="my.choice.of.destructive.Classes" action="deleteStuff" />
How can I control the environment / class access?
I tried this:
context.setClassLoader(new MyLoader());
with the loader class like so to filter out classes I want to allow:
public class MyLoader extends ClassLoader {
public Class loadClass(String name) throws ClassNotFoundException {
System.out.println("loading class = " + name);
if (name.startsWith("org.apache.commons.jelly.tags.")) return
super.loadClass(name);
else throw new ClassNotFoundException("Class not authorized");
}
}
but the only classes this loader loads are:
org.apache.commons.jelly.tags.define.DefineTagLibrary
org.apache.commons.jelly.tags.core.CoreTagLibrary
Any ideas?
Thanks.
Daryl Stultz
_____________________________________
6 Degrees Software and Consulting, Inc.
http://www.6degrees.com
mailto:daryl@6degrees.com
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org
Re: Jelly: and security
Posted by Daryl Stultz <da...@6degrees.com>.
"Jakarta Commons Users List" <co...@jakarta.apache.org> writes:
>What happens if you set your classloader to be the current thread's
>context class loader?
It seems to be more thorough, but not complete. For example,
java.util.logging.Logger is loaded by my class loader from Jelly code, but
java.net.Socket is not loaded by my loader when I try to instantiate it
with a jelly:new tag. I don't know much about class loaders, but if this
is the way to accomplish this I'll study class loaders more rather than
bug you folks here about it.
Daryl Stultz
_____________________________________
6 Degrees Software and Consulting, Inc.
http://www.6degrees.com
mailto:daryl@6degrees.com
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org
Re: Jelly: and security
Posted by di...@multitask.com.au.
What happens if you set your classloader to be the current thread's
context class loader?
--
dIon Gillard, Multitask Consulting
Blog: http://blogs.codehaus.org/people/dion/
"Daryl Stultz" <da...@6degrees.com> wrote on 13/09/2003 06:54:18 AM:
> Hi folks,
>
> Suppose I build a SOAP service that runs Jelly scripts (i.e. the client
> calls the service/method and passes in the Jelly script to be executed).
I
> want the client to be able to use core Jelly tags but I don't want them
to
> do things like:
>
> <j:new className="my.choice.of.destructive.Classes" action="deleteStuff"
/>
>
> How can I control the environment / class access?
>
> I tried this:
>
> context.setClassLoader(new MyLoader());
>
> with the loader class like so to filter out classes I want to allow:
>
> public class MyLoader extends ClassLoader {
> public Class loadClass(String name) throws ClassNotFoundException {
> System.out.println("loading class = " + name);
> if (name.startsWith("org.apache.commons.jelly.tags.")) return
> super.loadClass(name);
> else throw new ClassNotFoundException("Class not authorized");
> }
> }
>
> but the only classes this loader loads are:
>
> org.apache.commons.jelly.tags.define.DefineTagLibrary
> org.apache.commons.jelly.tags.core.CoreTagLibrary
>
> Any ideas?
>
> Thanks.
>
> Daryl Stultz
> _____________________________________
> 6 Degrees Software and Consulting, Inc.
> http://www.6degrees.com
> mailto:daryl@6degrees.com
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-user-help@jakarta.apache.org