You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2023/01/05 09:51:19 UTC
[tomcat] branch 9.0.x updated: Fix BZ 66370 Change default for GET_CLASSLOADER_USE_PRIVILEGED
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new d4f17e770a Fix BZ 66370 Change default for GET_CLASSLOADER_USE_PRIVILEGED
d4f17e770a is described below
commit d4f17e770a2772c94846b2e5f93fc88a84c60f8d
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Dec 15 17:17:04 2022 +0000
Fix BZ 66370 Change default for GET_CLASSLOADER_USE_PRIVILEGED
When running on Tomcat the EL library is called from within a
privileged block so the additional privileged block is unnecesary.
When not on Tomcat, use the additional privileged block
https://bz.apache.org/bugzilla/show_bug.cgi?id=66370
---
conf/catalina.properties | 4 ++++
java/javax/el/Util.java | 23 ++++++++++++++++++++---
webapps/docs/changelog.xml | 12 ++++++++++++
3 files changed, 36 insertions(+), 3 deletions(-)
diff --git a/conf/catalina.properties b/conf/catalina.properties
index 19f67180ea..779f761ca1 100644
--- a/conf/catalina.properties
+++ b/conf/catalina.properties
@@ -207,3 +207,7 @@ tomcat.util.buf.StringCache.byte.enabled=true
#tomcat.util.buf.StringCache.char.enabled=true
#tomcat.util.buf.StringCache.trainThreshold=500000
#tomcat.util.buf.StringCache.cacheSize=5000
+
+# Disable use of some privilege blocks Tomcat doesn't need since calls to the
+# code in question are always already inside a privilege block
+org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED=false
diff --git a/java/javax/el/Util.java b/java/javax/el/Util.java
index e1ae0851c0..10af9f2055 100644
--- a/java/javax/el/Util.java
+++ b/java/javax/el/Util.java
@@ -42,8 +42,25 @@ class Util {
private static final Class<?>[] EMPTY_CLASS_ARRAY = new Class<?>[0];
private static final Object[] EMPTY_OBJECT_ARRAY = new Object[0];
- private static final boolean GET_CLASSLOADER_USE_PRIVILEGED =
- Boolean.getBoolean("org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED");
+ private static final boolean IS_SECURITY_ENABLED = (System.getSecurityManager() != null);
+
+ private static final boolean GET_CLASSLOADER_USE_PRIVILEGED;
+
+ static {
+ if (IS_SECURITY_ENABLED) {
+ // Defaults to using a privileged block
+ // When running on Tomcat this will be set to false in
+ // $CATALINA_BASE/conf/catalina.properties
+ String value = AccessController.doPrivileged(
+ (PrivilegedAction<String>) () -> System.getProperty(
+ "org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED", "true"));
+ GET_CLASSLOADER_USE_PRIVILEGED = Boolean.parseBoolean(value);
+ } else {
+ // No security manager - no need to use a privileged block.
+ GET_CLASSLOADER_USE_PRIVILEGED = false;
+ }
+ }
+
/**
* Checks whether the supplied Throwable is one that needs to be
@@ -650,7 +667,7 @@ class Util {
static ClassLoader getContextClassLoader() {
ClassLoader tccl;
- if (System.getSecurityManager() != null && GET_CLASSLOADER_USE_PRIVILEGED) {
+ if (IS_SECURITY_ENABLED && GET_CLASSLOADER_USE_PRIVILEGED) {
PrivilegedAction<ClassLoader> pa = new PrivilegedGetTccl();
tccl = AccessController.doPrivileged(pa);
} else {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 882ad27eaf..dad9db1913 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -138,6 +138,18 @@
</fix>
</changelog>
</subsection>
+ <subsection name="Jasper">
+ <changelog>
+ <fix>
+ <bug>66370</bug>: Change the default of the
+ <code>org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED</code> system
+ property to <code>true</code> unless the EL library is running on Tomcat
+ in which case the default remains <code>false</code> as the EL library
+ is already called from within a privileged block and skipping the
+ unnecessary privileged block improves performance. (markt)
+ </fix>
+ </changelog>
+ </subsection>
<subsection name="Other">
<changelog>
<update>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org