You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2007/01/31 14:49:22 UTC
DO NOT REPLY [Bug 41509] New: - Jasper tries to add permissions to readonly PermissionCollection
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=41509>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=41509
Summary: Jasper tries to add permissions to readonly
PermissionCollection
Product: Tomcat 6
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: minor
Priority: P2
Component: Jasper
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: valder@yandex.ru
Javadoc:
http://java.sun.com/javase/6/docs/api/java/security/Policy.html#getPermissions
(java.security.CodeSource)
Policy Javadoc says that method getPermissions(java.security.CodeSource) is
optional and policies do not have to implement it. At least nobody said that
returned collection will be editable. So to avoid exceptions a possible
solution is to check whether permissions can be added before trying to do that.
Stacktrace:
java.lang.SecurityException: attempt to add a Permission to a readonly
Permissions object
at java.security.Permissions.add(Permissions.java:110)
at java.security.Policy$UnsupportedEmptyCollection.add(Policy.java:790)
at org.apache.jasper.compiler.JspRuntimeContext.initSecurity
(JspRuntimeContext.java:487)
at org.apache.jasper.compiler.JspRuntimeContext.<init>
(JspRuntimeContext.java:142)
at org.apache.jasper.servlet.JspServlet.init(JspServlet.java:121)
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 41509] - Jasper tries to add permissions to readonly PermissionCollection
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=41509>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=41509
------- Additional Comments From jongjin.choe@gmail.com 2007-05-29 06:03 -------
(In reply to comment #0)
How can I reproduce this situation? Do you have any test cases?
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 41509] - Jasper tries to add permissions to readonly PermissionCollection
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=41509>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=41509
------- Additional Comments From valder@yandex.ru 2007-05-30 00:50 -------
(In reply to comment #1)
> (In reply to comment #0)
> How can I reproduce this situation? Do you have any test cases?
>
It isn't very easy to write testcase for jasper :(
idea:
1) set Policy to
Policy.setPolicy(new Policy() {
public boolean implies(ProtectionDomain domain, Permission permission) {
return true;
}
public PermissionCollection getPermissions(ProtectionDomain domain) {
return Policy.UNSUPPORTED_EMPTY_COLLECTION;
}
public PermissionCollection getPermissions(CodeSource codesource) {
return Policy.UNSUPPORTED_EMPTY_COLLECTION;
}
});
such policy won't break the vm, since it allows everything.
2) set SecurityManager
System.setSecurityManager(new SecurityManager())
3) instantiate JspRuntimeContext
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org