DO NOT REPLY [Bug 29804] New: - JSP ClassLoader doesn't delegate to parent for permissions

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=29804>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=29804

JSP ClassLoader doesn't delegate to parent for permissions

           Summary: JSP ClassLoader doesn't delegate to parent for
                    permissions
           Product: Tomcat 4
           Version: 4.1.29
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Jasper 2
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: b.armintor@its.utexas.edu


I'm subclassing the WebappClassLoader to add permissions at runtime.  Because
the JSP class loader does not delegate to its parent for permissions before
adding its own, these permissions are not assigned to JSP-derived servlets.  The
problem comes from org.apache.jasper.compiler.JspRuntimeContext, which gets a
permissions collection from the Policy directly, instead of delegating to the
ParentClassLoader#getPermissions() method when assigning its
permissionCollection member's values in JspRuntimeContext#initSecurity().  This
problem also exists in the TC5.0.25 codebase.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org