You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Daniel John Debrunner (JIRA)" <ji...@apache.org> on 2007/02/13 18:30:05 UTC

[jira] Created: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
------------------------------------------------------------------------------------------------------------------

                 Key: DERBY-2331
                 URL: https://issues.apache.org/jira/browse/DERBY-2331
             Project: Derby
          Issue Type: Improvement
          Components: Security
            Reporter: Daniel John Debrunner
         Assigned To: Daniel John Debrunner
             Fix For: 10.3.0.0


Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.

Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.

Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

[jira] Closed: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Posted by "Myrna van Lunteren (JIRA)" <ji...@apache.org>.
     [ https://issues.apache.org/jira/browse/DERBY-2331?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Myrna van Lunteren closed DERBY-2331.
-------------------------------------

       Resolution: Fixed
    Fix Version/s:     (was: 10.3.1.0)
                   10.3.1.1

> Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-2331
>                 URL: https://issues.apache.org/jira/browse/DERBY-2331
>             Project: Derby
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Daniel John Debrunner
>            Assignee: Daniel John Debrunner
>             Fix For: 10.3.0.0, 10.3.1.1
>
>
> Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.
> Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.
> Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

[jira] Closed: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
     [ https://issues.apache.org/jira/browse/DERBY-2331?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Daniel John Debrunner closed DERBY-2331.
----------------------------------------


> Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-2331
>                 URL: https://issues.apache.org/jira/browse/DERBY-2331
>             Project: Derby
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Daniel John Debrunner
>            Assignee: Daniel John Debrunner
>             Fix For: 10.3.0.0, 10.3.1.0
>
>
> Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.
> Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.
> Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

[jira] Resolved: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Posted by "Daniel John Debrunner (JIRA)" <ji...@apache.org>.
     [ https://issues.apache.org/jira/browse/DERBY-2331?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Daniel John Debrunner resolved DERBY-2331.
------------------------------------------

       Resolution: Fixed
    Fix Version/s: 10.3.1.0

Fixed in 10.3 branch and trunk.

> Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-2331
>                 URL: https://issues.apache.org/jira/browse/DERBY-2331
>             Project: Derby
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Daniel John Debrunner
>            Assignee: Daniel John Debrunner
>             Fix For: 10.3.0.0, 10.3.1.0
>
>
> Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.
> Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.
> Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

[jira] Reopened: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Posted by "Myrna van Lunteren (JIRA)" <ji...@apache.org>.
     [ https://issues.apache.org/jira/browse/DERBY-2331?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Myrna van Lunteren reopened DERBY-2331:
---------------------------------------


> Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-2331
>                 URL: https://issues.apache.org/jira/browse/DERBY-2331
>             Project: Derby
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Daniel John Debrunner
>            Assignee: Daniel John Debrunner
>             Fix For: 10.3.0.0, 10.3.1.0
>
>
> Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.
> Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.
> Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

[jira] Commented: (DERBY-2331) Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.

Posted by "Myrna van Lunteren (JIRA)" <ji...@apache.org>.
    [ https://issues.apache.org/jira/browse/DERBY-2331?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12502671 ] 

Myrna van Lunteren commented on DERBY-2331:
-------------------------------------------

It does not appear this issue will get addressed before 6/14/07. 
Can I remove the 10.3 fix in?

> Disallow code in installed jars from resolving classes in the org.apache.derby.* namespace except for public apis.
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: DERBY-2331
>                 URL: https://issues.apache.org/jira/browse/DERBY-2331
>             Project: Derby
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Daniel John Debrunner
>            Assignee: Daniel John Debrunner
>             Fix For: 10.3.0.0
>
>
> Since Derby is open source and (obviously) contains the code to read database files and is modular the potential exists that routines could utilize code on the classpath to read/modify database information directly, bypassing SQL level security.
> Derby is a special case here as it is known that Derby code will be on the classpath and that it will have the correct permissions to read/write database files.
> Existing routines from upgraded databases will fail at execute time when they try to resolve such classes.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.