You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Justin Bertram (Jira)" <ji...@apache.org> on 2024/09/03 18:57:00 UTC
[jira] [Commented] (ARTEMIS-4933) org.apache.activemq.artemis.boot.Artemis.execute(File, File, String[]) creates a java.net.URLClassLoader classloader, which should be performed within a doPrivileged block
[ https://issues.apache.org/jira/browse/ARTEMIS-4933?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17878984#comment-17878984 ]
Justin Bertram commented on ARTEMIS-4933:
-----------------------------------------
I'm not entirely sure this is necessary given the fact that the Security Manager is being removed from Java completely.
> org.apache.activemq.artemis.boot.Artemis.execute(File, File, String[]) creates a java.net.URLClassLoader classloader, which should be performed within a doPrivileged block
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: ARTEMIS-4933
> URL: https://issues.apache.org/jira/browse/ARTEMIS-4933
> Project: ActiveMQ Artemis
> Issue Type: Bug
> Reporter: Suhov Roman
> Priority: Major
>
> file: [https://github.com/apache/activemq-artemis/blob/main/artemis-boot/src/main/java/org/apache/activemq/artemis/boot/Artemis.java]
> line: 146
> Instantiating a {{URLClassLoader}} in the {{execute}} method without using a {{doPrivileged}} block can cause problems, especially in security-restricted environments such as the Java Security Manager.
> You need to wrap the {{URLClassLoader}} creation in a {{doPrivileged}} block something like this:
> {code:java}
> ClassLoader originalCL = Thread.currentThread().getContextClassLoader();
> try {
> URLClassLoader loader = AccessController.doPrivileged((PrivilegedAction<URLClassLoader>) () ->
> new URLClassLoader(urls.toArray(new URL[urls.size()])));
> Thread.currentThread().setContextClassLoader(loader);
> Class<?> clazz = loader.loadClass("org.apache.activemq.artemis.cli.Artemis");
> Method method = clazz.getMethod("execute", Boolean.TYPE, File.class, File.class, args.getClass());
> try {
> return method.invoke(null, true, fileHome, fileInstance, args);
> } catch (InvocationTargetException e) {
> throw e.getTargetException();
> }
> } finally {
> Thread.currentThread().setContextClassLoader(originalCL);
> }{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@activemq.apache.org
For additional commands, e-mail: issues-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact