You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@xalan.apache.org by "Christine Li (JIRA)" <xa...@xml.apache.org> on 2004/12/07 21:33:09 UTC
[jira] Created: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
non-private non-final static variables and mutable static variables open potential security holes in Xalan
----------------------------------------------------------------------------------------------------------
Key: XALANJ-2008
URL: http://nagoya.apache.org/jira/browse/XALANJ-2008
Project: XalanJ2
Type: Bug
Components: Xalan
Versions: CurrentCVS
Environment: Distributed with JDK 1.4+
Reporter: Christine Li
According to Suns Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Brian Minchau (JIRA)" <xa...@xml.apache.org>.
[ http://issues.apache.org/jira/browse/XALANJ-2008?page=history ]
Brian Minchau updated XALANJ-2008:
----------------------------------
Xalan info: (was: [PatchAvailable])
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://issues.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: CurrentCVS
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Henry Zongaro (JIRA)" <xa...@xml.apache.org>.
[ http://nagoya.apache.org/jira/browse/XALANJ-2008?page=history ]
Henry Zongaro updated XALANJ-2008:
----------------------------------
Description:
According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
was:
According to Suns Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
Xalan-keywords: PatchAvailable
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://nagoya.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Attachments: SecurityFixes.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Brian Minchau (JIRA)" <xa...@xml.apache.org>.
[ http://issues.apache.org/jira/browse/XALANJ-2008?page=all ]
Brian Minchau updated XALANJ-2008:
----------------------------------
Fix Version: 2.7
(was: CurrentCVS)
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://issues.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: 2.7
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Closed: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Christine Li (JIRA)" <xa...@xml.apache.org>.
[ http://issues.apache.org/jira/browse/XALANJ-2008?page=all ]
Christine Li closed XALANJ-2008:
--------------------------------
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://issues.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: Latest Development Code
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: 2.7
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Brian Minchau (JIRA)" <xa...@xml.apache.org>.
[ http://issues.apache.org/jira/browse/XALANJ-2008?page=history ]
Brian Minchau updated XALANJ-2008:
----------------------------------
reviewer: zongaro@ca.ibm.com
Filling in the reviewer field.
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://issues.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: CurrentCVS
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Christine Li (JIRA)" <xa...@xml.apache.org>.
[ http://nagoya.apache.org/jira/browse/XALANJ-2008?page=history ]
Christine Li updated XALANJ-2008:
---------------------------------
Attachment: SecurityFixesFinal.txt
The final version of the patch. Special thanks to Brian Minchau for providing the patch for
org.apache.xalan.templates.StylesheetRoot.java and org.apache.xalan.templates.ElemExsltFunction.java.
Many thanks to Brian Minchau and Henry Zongaro for reviewing the patch.
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://nagoya.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Resolved: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Christine Li (JIRA)" <xa...@xml.apache.org>.
[ http://nagoya.apache.org/jira/browse/XALANJ-2008?page=history ]
Christine Li resolved XALANJ-2008:
----------------------------------
Resolution: Fixed
Fix Version: CurrentCVS
The patch has been applied to current CVS.
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://nagoya.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: CurrentCVS
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org
[jira] Updated: (XALANJ-2008) non-private non-final static variables and mutable static variables open potential security holes in Xalan
Posted by "Brian Minchau (JIRA)" <xa...@xml.apache.org>.
[ http://issues.apache.org/jira/browse/XALANJ-2008?page=history ]
Brian Minchau updated XALANJ-2008:
----------------------------------
Xalan info: [PatchAvailable]
> non-private non-final static variables and mutable static variables open potential security holes in Xalan
> ----------------------------------------------------------------------------------------------------------
>
> Key: XALANJ-2008
> URL: http://issues.apache.org/jira/browse/XALANJ-2008
> Project: XalanJ2
> Type: Bug
> Components: Xalan
> Versions: CurrentCVS
> Environment: Distributed with JDK 1.4+
> Reporter: Christine Li
> Fix For: CurrentCVS
> Attachments: SecurityFixes.txt, SecurityFixesFinal.txt
>
> According to Sun's Security Code Guidelines [http://java.sun.com/security/seccodeguide.html#gcg2], non-final static variables and mutable static variables can cause unintended interactions within the system. This problem appears in many classes in the current Xalan code.
> This security issue becomes more severe when Xalan are distributed as part of the JRE 1.4+; It is loaded by the system class loader and stay in the JVM as long as the JVM is alive, malicious code can change the behavior of a processor by modifying those static variables.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org