[jira] Resolved: (SLING-866) Shield Sling from the classes and resources in the environment

["Felix Meschberger (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SLING-866?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Felix Meschberger resolved SLING-866.
-------------------------------------

    Resolution: Fixed

Created a LauncherClassLoader (extends URLClassLoader) in Rev. 746794, which takes care of ensuring
that the contents of the launcher jar (except META-INF and javax) is never loaded from the parent class loader
chain.

> Shield Sling from the classes and resources in the environment
> --------------------------------------------------------------
>
>                 Key: SLING-866
>                 URL: https://issues.apache.org/jira/browse/SLING-866
>             Project: Sling
>          Issue Type: Improvement
>          Components: Launchpad Launcher
>    Affects Versions: Launchpad Base 2.0.4
>            Reporter: Felix Meschberger
>            Assignee: Felix Meschberger
>             Fix For: Launchpad Base 2.0.4
>
>
> As noted in [1], Sling suffers from leaking classes from the environment. This particularly is a problem with the Apache Felix framework classes (most notably in the case of Glassfish v3 Prelude) and the OSGi core and compendium libraries, which may be leaked from other containers classloaders as well.
> To shield Sling from this leakage, the ClassLoader created to load the launcher JAR should be set up such, that classes from packages contained in the launcher JAR file should never be tried to be loaded from the environment. An exception to this rule is the META-INF folder contents and any classes in below the javax root package (most notable the javax.servlet classes, which must be loaded from the servlet container to prevent class cast problems).
> [1] http://markmail.org/thread/x36xkkgj2ohbmcmd

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.