You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by Сергій Карташов <ka...@gmail.com> on 2011/06/23 13:07:18 UTC
[Axis2] Fixed issues with security.
Hi guys,
Our application uses Axis2 v1.5. We want to using our application with
enabled security manager on web server (Web Sphere v7.0) without next
permissions:
- createClassLoader issue
- temp folder issue
- setContextClassLoader issue
- was.install.root issue
Currently those permissions should be removed from was.policy file.
grant codeBase "file:application.war" {
permission java.io.FilePermission
"${user.install.root}${/}temp${/}-", "read, write, delete";
permission java.io.FilePermission "${java.io.tmpdir}", "read,
write, delete";
permission java.io.FilePermission "${java.io.tmpdir}${/}-", "read,
write, delete";
permission java.io.FilePermission "${was.install.root}${/}-","read";
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "setContextClassLoader";
permission com.ibm.oti.shared.SharedClassPermission
"org.apache.axis2.deployment.DeploymentClassLoader", "read, write";
};
So, we got the source code -
http://archive.apache.org/dist/ws/axis2/1_5/axis2-1.5-src.zip and made
the changes to fix that issues.
Could you please review our changes and commit it to you trunk or
working branch? Certainly if those changes will possible for new
releases.
So, how we fixed it:
* createClassLoader issue
- Utils.createDeploymentClassLoader() changed and renamed to
createInstanceClassLoader. Now it return class loader of type
ClassLoader instead of DeploymentClassLoader
- Public static ClassLoader.getClassLoader(ClassLoader arg1,
String arg2) changed. Now it uses ClassLoader.newInstance() method
instead of constructor to create class loaders.
- DeploymentClassLoader removed completely because it used
to load classes from aar and mar files. We unpacked these archives so
we don=92t need special class loader. We use ClassLoader instead.
All changes mentioned above works correctly since we have all modules
and services classes on classpath, because structure of our
application has been reorganized.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.DeploymentClassLoader
org.apache.axis2.deployment.DeploymentEngine
org.apache.axis2.deployment.util.Utils
* temp folder issue
Application will not halt when temp folder is unreachable for
WarBasedAxisConfigurator (package org.apache.axis2.deployment). Also
we=92ve added check if temp folder is reachable for
org.apache.axis2.deployment.util.TempFileManager. In case the folder
is unreachable, this class will skip all operations with it.
We=92ve found that class org.apache.axis2.context.ConfigurationContext
in Axis2 had tried to clean temp folder. We used the same approach as
in TempFileManager manager to fix it.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.util.Utils
org.apache.axis2.context.ConfigurationContext
org.apache.axis2.deployment.util.TempFileManager
org.apache.axis2.deployment.WarBasedAxisConfigurator
* was.install.root folder access issue
Axis2 has searched some jars in "was.install.root" folder and has
tried to read it. We can suggest that it have searched some modules or
services there. We applied fix to prevent Axis2 fault if it has no
permission to read files in "was.install.root" folder.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.RepositoryListener
org.apache.axis2.util.Utils
* setContextClassLoader issue
Number of classes in Axis2 has workflow which brakes
setContextClassLoader permission.
Our application uses two classes (AbstractMessageReceiver and JAXWSDeployer=
).
All of them have same behavior. Here is brief description:
ClassLoader threadClassLoader =3D null;
try {
threadClassLoader =3D Thread.currentThread().getContextClassLoader();
operation();//here classloader might change
} catch (Exception e) {
log.info(Messages.getMessage("deployingexception", e.getMessage()), e);
try {
if (threadClassLoader !=3D null) {
log.info("We are in old finally block");
SecurityManager security =3D System.getSecurityManager();
if (security !=3D null) {
security.checkPermission(new RuntimePermission("setContextClassLoader"));
}
Thread.currentThread().setContextClassLoader(threadClassLoader);
}
} catch (SecurityException e) {
log.info("We have security restriction on setContextClassLoader");
}
operation() never change classloader if we have security permission.
So if we have no security restrictions on setContextClassLoader, the
behavior of application won=92t be change. And in case if we have no
permission to change context classloader, application will work
propertly but also will notify about restriction.
The next classes were changed (see diff file below):
org.apache.axis2.jaxws.framework.JAXWSDeployer
org.apache.axis2.receivers.AbstractMessageReceiver
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
[Axis2] Fixed issues with security.
Posted by Сергій Карташов <ka...@gmail.com>.
Hi guys,
Our application uses Axis2 v1.5. We want to using our application with
enabled security manager on web server (Web Sphere v7.0) without next
permissions:
- createClassLoader issue
- temp folder issue
- setContextClassLoader issue
- was.install.root issue
Currently those permissions should be removed from was.policy file.
grant codeBase "file:application.war" {
permission java.io.FilePermission
"${user.install.root}${/}temp${/}-", "read, write, delete";
permission java.io.FilePermission "${java.io.tmpdir}", "read,
write, delete";
permission java.io.FilePermission "${java.io.tmpdir}${/}-", "read,
write, delete";
permission java.io.FilePermission "${was.install.root}${/}-","read";
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "setContextClassLoader";
permission com.ibm.oti.shared.SharedClassPermission
"org.apache.axis2.deployment.DeploymentClassLoader", "read, write";
};
So, we got the source code -
http://archive.apache.org/dist/ws/axis2/1_5/axis2-1.5-src.zip and made
the changes to fix that issues.
Could you please review our changes and commit it to you trunk or
working branch? Certainly if those changes will possible for new
releases.
So, how we fixed it:
* createClassLoader issue
- Utils.createDeploymentClassLoader() changed and renamed to
createInstanceClassLoader. Now it return class loader of type
ClassLoader instead of DeploymentClassLoader
- Public static ClassLoader.getClassLoader(ClassLoader arg1,
String arg2) changed. Now it uses ClassLoader.newInstance() method
instead of constructor to create class loaders.
- DeploymentClassLoader removed completely because it used
to load classes from aar and mar files. We unpacked these archives so
we don=92t need special class loader. We use ClassLoader instead.
All changes mentioned above works correctly since we have all modules
and services classes on classpath, because structure of our
application has been reorganized.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.DeploymentClassLoader
org.apache.axis2.deployment.DeploymentEngine
org.apache.axis2.deployment.util.Utils
* temp folder issue
Application will not halt when temp folder is unreachable for
WarBasedAxisConfigurator (package org.apache.axis2.deployment). Also
we=92ve added check if temp folder is reachable for
org.apache.axis2.deployment.util.TempFileManager. In case the folder
is unreachable, this class will skip all operations with it.
We=92ve found that class org.apache.axis2.context.ConfigurationContext
in Axis2 had tried to clean temp folder. We used the same approach as
in TempFileManager manager to fix it.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.util.Utils
org.apache.axis2.context.ConfigurationContext
org.apache.axis2.deployment.util.TempFileManager
org.apache.axis2.deployment.WarBasedAxisConfigurator
* was.install.root folder access issue
Axis2 has searched some jars in "was.install.root" folder and has
tried to read it. We can suggest that it have searched some modules or
services there. We applied fix to prevent Axis2 fault if it has no
permission to read files in "was.install.root" folder.
The next classes were changed (see diff file below):
org.apache.axis2.deployment.RepositoryListener
org.apache.axis2.util.Utils
* setContextClassLoader issue
Number of classes in Axis2 has workflow which brakes
setContextClassLoader permission.
Our application uses two classes (AbstractMessageReceiver and JAXWSDeployer=
).
All of them have same behavior. Here is brief description:
ClassLoader threadClassLoader =3D null;
try {
threadClassLoader =3D Thread.currentThread().getContextClassLoader();
operation();//here classloader might change
} catch (Exception e) {
log.info(Messages.getMessage("deployingexception", e.getMessage()), e);
try {
if (threadClassLoader !=3D null) {
log.info("We are in old finally block");
SecurityManager security =3D System.getSecurityManager();
if (security !=3D null) {
security.checkPermission(new RuntimePermission("setContextClassLoader"));
}
Thread.currentThread().setContextClassLoader(threadClassLoader);
}
} catch (SecurityException e) {
log.info("We have security restriction on setContextClassLoader");
}
operation() never change classloader if we have security permission.
So if we have no security restrictions on setContextClassLoader, the
behavior of application won=92t be change. And in case if we have no
permission to change context classloader, application will work
propertly but also will notify about restriction.
The next classes were changed (see diff file below):
org.apache.axis2.jaxws.framework.JAXWSDeployer
org.apache.axis2.receivers.AbstractMessageReceiver
Index: D:/.../projects/axis2-1.5/modules/jaxbri/pom.xml
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentClassLoader.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentClassLoader.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentClassLoader.java (revision
564)
@@ -1,263 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.axis2.deployment;
-
-import org.apache.axiom.attachments.utils.IOUtils;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.URL;
-import java.net.URLClassLoader;
-import java.net.URLConnection;
-import java.net.URLStreamHandler;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.List;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-
-public class DeploymentClassLoader extends URLClassLoader {
- // List of URL's
- private URL[] urls = null;
-
- // List of jar files inside the jars in the original url
- private List embedded_jars;
-
- /**
- * DeploymentClassLoader is extended from URLClassLoader. The constructor
- * does not override the super constructor, but takes in an
addition list of
- * jar files inside /lib directory.
- *
- * @param urls <code>URL</code>s
- * @param parent parent classloader <code>ClassLoader</code>
- */
- public DeploymentClassLoader(URL[] urls, List embedded_jars,
ClassLoader parent) {
- super(urls, parent);
- this.urls = urls;
- this.embedded_jars = embedded_jars;
- }
-
- /**
- * Finds and loads the class with the specified name from the URL search
- * path. Any URLs referring to JAR files are loaded and opened as needed
- * until the class is found.
- *
- * @param name the name of the class
- * @return the resulting class
- * @exception ClassNotFoundException if the class could not be found
- */
- protected Class findClass(String name) throws ClassNotFoundException {
- Class clazz;
- try {
- clazz = super.findClass(name);
- } catch (ClassNotFoundException e) {
- byte raw[] = null;
- try {
- String completeFileName = name;
- /**
- * Replacing org.apache. -> org/apache/...
- */
- completeFileName = completeFileName.replace('.',
'/').concat(".class");
- raw = getBytes(completeFileName);
- } catch (Exception ex) {
- // Fall through
- }
- if (raw == null) {
- throw new ClassNotFoundException("Class Not found : " + name);
- }
- clazz = defineClass(name, raw, 0, raw.length);
- }
- return clazz;
- }
-
-
- /**
- * Finds the resource with the specified name on the URL search path.
- *
- * @param resource the name of the resource
- * @return a <code>URL</code> for the resource, or <code>null</code>
- * if the resource could not be found.
- */
- public URL findResource(String resource) {
- URL url = super.findResource(resource);
- if (url == null) {
- for (int i = 0; embedded_jars != null && i <
embedded_jars.size(); i++) {
- String libjar_name = (String) embedded_jars.get(i);
- try {
- InputStream in = getJarAsStream(libjar_name);
- ZipInputStream zin = new ZipInputStream(in);
- ZipEntry entry;
- String entryName;
- while ((entry = zin.getNextEntry()) != null) {
- entryName = entry.getName();
- if (entryName != null &&
- entryName.endsWith(resource)) {
- byte[] raw = IOUtils.getStreamAsByteArray(zin);
- return new URL("jar", "", -1, urls[0] +
"!/" + libjar_name + "!/" + entryName,
- new ByteUrlStreamHandler(raw));
- }
- }
- } catch (Exception e) {
- throw new RuntimeException(e);
- }
- }
- }
- return url;
- }
-
- /**
- * Returns an Enumeration of URLs representing all of the resources
- * on the URL search path having the specified name.
- *
- * @param resource the resource name
- * @exception IOException if an I/O exception occurs
- * @return an <code>Enumeration</code> of <code>URL</code>s
- */
- public Enumeration findResources(String resource) throws IOException {
- ArrayList resources = new ArrayList();
- Enumeration e = super.findResources(resource);
- while (e.hasMoreElements()) {
- resources.add(e.nextElement());
- }
- for (int i = 0; embedded_jars != null && i <
embedded_jars.size(); i++) {
- String libjar_name = (String) embedded_jars.get(i);
- try {
- InputStream in = getJarAsStream(libjar_name);
- ZipInputStream zin = new ZipInputStream(in);
- ZipEntry entry;
- String entryName;
- while ((entry = zin.getNextEntry()) != null) {
- entryName = entry.getName();
- if (entryName != null &&
- entryName.endsWith(resource)) {
- byte[] raw = IOUtils.getStreamAsByteArray(zin);
- resources.add(new URL("jar", "", -1, urls[0]
+ "!/" + libjar_name + "!/" + entryName,
- new ByteUrlStreamHandler(raw)));
- }
- }
- } catch (Exception ex) {
- throw new RuntimeException(ex);
- }
- }
- return Collections.enumeration(resources);
- }
-
- /**
- * Access the jars file (/lib) one by one , then for each one
create a <code>ZipInputStream</code>
- * and check to see whether there is any entry eith given name.
if it is found then
- * return the byte array for that
- *
- * @param resource <code>String</code> Name of the file to be found
- * @return byte[]
- * @throws java.io.IOException <code>Exception</code>
- */
- private byte[] getBytes(String resource) throws Exception {
- for (int i = 0; embedded_jars != null && i <
embedded_jars.size(); i++) {
- String libjar_name = (String) embedded_jars.get(i);
- InputStream in = getJarAsStream(libjar_name);
- byte[] bytes = getBytes(in, resource);
- if(bytes != null) {
- return bytes;
- }
- }
- return null;
- }
-
- /**
- * Get a specific entry's content as a byte array
- *
- * @param in
- * @param resource
- * @return
- * @throws Exception
- */
- private byte[] getBytes(InputStream in, String resource) throws Exception {
- ZipInputStream zin = new ZipInputStream(in);
- ZipEntry entry;
- String entryName;
- while ((entry = zin.getNextEntry()) != null) {
- entryName = entry.getName();
- if (entryName != null &&
- entryName.endsWith(resource)) {
- byte[] raw = IOUtils.getStreamAsByteArray(zin);
- zin.close();
- return raw;
- }
- }
- return null;
- }
-
- /**
- * Get the specified embedded jar from the main jar
- *
- * @param libjar_name
- * @return
- * @throws Exception
- */
- private InputStream getJarAsStream(String libjar_name) throws Exception {
- return new
ByteArrayInputStream(getBytes(urls[0].openStream(), libjar_name));
- }
-
- public static class ByteUrlStreamHandler extends URLStreamHandler {
- private byte[] bytes;
-
- public ByteUrlStreamHandler(byte[] bytes) {
- this.bytes = bytes;
- }
-
- protected URLConnection openConnection(URL u) throws IOException {
- return new ByteURLConnection(u, bytes);
- }
- }
-
- public static class ByteURLConnection extends URLConnection {
- protected byte[] bytes;
-
- public ByteURLConnection(URL url, byte[] bytes) {
- super(url);
- this.bytes = bytes;
- }
-
- public void connect() {
- }
-
- public InputStream getInputStream() {
- return new ByteArrayInputStream(bytes);
- }
- }
-
- public InputStream getResourceAsStream(String name) {
- URL url = findResource(name);
- if(url == null) {
- url = getResource(name);
- }
- if(url!=null){
- try {
- return url.openStream();
- } catch (IOException e) {
- throw new RuntimeException(e);
- }
- }
- return null;
- }
-}
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/repository/util/DeploymentFileData.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/repository/util/DeploymentFileData.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/repository/util/DeploymentFileData.java (revision
564)
@@ -26,6 +26,8 @@
import org.apache.axis2.deployment.DeploymentException;
import org.apache.axis2.deployment.util.Utils;
import org.apache.axis2.i18n.Messages;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
import java.io.File;
import java.net.URL;
@@ -39,6 +41,11 @@
private ClassLoader classLoader;
private Deployer deployer;
+ /**
+ * Logger.
+ */
+ Log log = LogFactory.getLog(DeploymentFileData.class);
+
public DeploymentFileData(File file) {
this.file = file;
}
@@ -102,27 +109,46 @@
this.classLoader = classLoader;
}
- public void setClassLoader(boolean isDirectory, ClassLoader
parent, File file) throws AxisFault {
- if (!isDirectory) {
- if (this.file != null) {
- URL[] urlsToLoadFrom;
- try {
- if (!this.file.exists()) {
- throw new
AxisFault(Messages.getMessage(DeploymentErrorMsgs.FILE_NOT_FOUND,
-
this.file.getAbsolutePath()));
- }
- urlsToLoadFrom = new URL[]{this.file.toURL()};
- classLoader =
Utils.createClassLoader(urlsToLoadFrom, parent, true, file);
- } catch (Exception e) {
- throw AxisFault.makeFault(e);
- }
- }
- } else {
- if (this.file != null) {
- classLoader = Utils.getClassLoader(parent, this.file);
- }
- }
- }
+ /**
+ * Method give artifacts from directory and new create ClassLoader.
+ *
+ * Reviewer SK: 1. added comments; 2. formatted code.
+ *
+ * @param isDirectory
+ * boolean field: <code>true</code> - if it's directory,
+ * <code>false</code> - otherwise.
+ * @param parent
+ * the parent {@link ClassLoader}.
+ * @param file
+ * the directory with artifacts.
+ * @throws AxisFault
+ * the {@link AxisFault}.
+ */
+ public void setClassLoader(boolean isDirectory, ClassLoader parent,
+ File file) throws AxisFault {
+ if (!isDirectory) {
+ if (this.file != null) {
+ URL[] urlsToLoadFrom;
+ try {
+ if (!this.file.exists()) {
+ throw new AxisFault(Messages.getMessage(
+ DeploymentErrorMsgs.FILE_NOT_FOUND,
+ this.file.getAbsolutePath()));
+ }
+ urlsToLoadFrom = new URL[] { this.file.toURL() };
+ classLoader = Utils.createClassLoader(urlsToLoadFrom,
+ parent, true, file);
+ } catch (Exception e) {
+ log.info(e.getMessage(), e);
+ throw AxisFault.makeFault(e);
+ }
+ }
+ } else {
+ if (this.file != null) {
+ classLoader = Utils.getClassLoader(parent, this.file);
+ }
+ }
+ }
public Deployer getDeployer() {
return deployer;
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/WarBasedAxisConfigurator.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/WarBasedAxisConfigurator.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/WarBasedAxisConfigurator.java (revision
564)
@@ -19,6 +19,18 @@
package org.apache.axis2.deployment;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.HashMap;
+
+import javax.servlet.ServletConfig;
+import javax.xml.stream.XMLStreamException;
+
import org.apache.axis2.AxisFault;
import org.apache.axis2.Constants;
import org.apache.axis2.context.ConfigurationContext;
@@ -32,27 +44,43 @@
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import javax.servlet.ServletConfig;
-import javax.xml.stream.XMLStreamException;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.HashMap;
-
/**
* Processes the init parameters for the AxisServlet.
* This allows the location of the axis2.xml and the module
repository to be different from the default locations.
* The init parameters support alternate file, or URL values for both of these.
*/
public class WarBasedAxisConfigurator extends DeploymentEngine
implements AxisConfigurator {
+
+ /**
+ * Message about temporary folder.
+ */
+ private static final String DONT_HAVE_TEMP_FOLDER =
"WarBasedAxisConfigurator: Don't stop if we don't have temp folder, we
can deal with this";//$NON-NLS-1$
- private static final Log log =
LogFactory.getLog(WarBasedAxisConfigurator.class);
- private ServletConfig config;
+ /**
+ * The prefix.
+ */
+ private static final String _AXIS2 = "_axis2"; //$NON-NLS-1$
+ /**
+ * The name of java temporary folder property.
+ */
+ private static final String JAVA_IO_TMPDIR = "java.io.tmpdir"; //$NON-NLS-1$
+
+ /**
+ * Message about security restriction.
+ */
+ private static final String SECURITY_RESTRICTION =
"WarBasedAxisConfigurator: We have security restriction accessing
file: "; //$NON-NLS-1$
+
+ /**
+ * Java logs.
+ */
+ private static final Log log =
LogFactory.getLog(WarBasedAxisConfigurator.class);
+
+ /**
+ * The {@link ServletConfig}.
+ */
+ private ServletConfig config;
+
/**
* The name of the init parameter (axis2.xml.path) that can be
used to override the default location for the axis2.xml file. When
both this init parameter, and the axis2.xml.url init parameters are
not specified in the axis servlet init-parameter, the default location
of ${app}/WEB-INF/conf/axis2.xml is used.
* The value of this path is interpreted as a file system absolute path.
@@ -161,31 +189,60 @@
}
Parameter param = new Parameter();
param.setName(Constants.Configuration.ARTIFACTS_TEMP_DIR);
- File f = new File((File)
config.getServletContext().getAttribute("javax.servlet.context.tempdir"),
"_axis2");
- if (f.exists() || f.mkdirs()) {
- param.setValue(f);
- } else {
- f = new File(System.getProperty("java.io.tmpdir"), "_axis2");
- if (f.exists() || f.mkdirs()) {
- param.setValue(f);
- } else {
- throw new DeploymentException("Unable to create a
temporary working directory");
- }
+ File f = new File((File)
config.getServletContext().getAttribute("javax.servlet.context.tempdir"),
_AXIS2);
+
+ if (checkReadWriteAccess(f) && (f.exists() || f.mkdirs())) {
+ param.setValue(f);
+ } else {
+ f = new File(System.getProperty(JAVA_IO_TMPDIR), _AXIS2);
+ if (checkReadWriteAccess(f) && (f.exists() || f.mkdirs())) {
+ param.setValue(f);
+ } else {
+ throw new DeploymentException(
+ "Unable to create a temporary working directory"); //$NON-NLS-1$
+ }
}
try {
axisConfig.addParameter(param);
} catch (AxisFault axisFault) {
log.error(axisFault.getMessage(), axisFault);
}
- } catch (DeploymentException e) {
- log.error(e.getMessage(), e);
- throw e;
- } catch (IOException e) {
- log.error(e.getMessage(), e);
- }
+ } catch (DeploymentException e) {
+ log.info(DONT_HAVE_TEMP_FOLDER);
+ log.debug(e.getMessage(), e);
+ } catch (IOException e) {
+ log.error(e.getMessage(), e);
+ }
}
+ /**
+ * Method track <b>read</b> and <b>write</b> permissions for specified file.
+ *
+ * @param file
+ * The file specified by the string argument
+ * @return return <code>true</code> if the calling thread is allowed to read
+ * and write the file specified by the string argument,
+ * <code>false</code> if not allowed.
+ */
+ private boolean checkReadWriteAccess(File file) {
+ boolean flag = false;
+ try {
+ if (file.canRead() && file.canWrite()) {
+ SecurityManager security = System.getSecurityManager();
+ if (security != null) {
+ security.checkRead(file.toString());
+ security.checkWrite(file.toString());
+ }
+ flag = true;
+ }
+ } catch (SecurityException e) {
+ log.info(SECURITY_RESTRICTION + file.toString());
+ log.debug(e.getMessage(), e);
+ }
+ return flag;
+ }
+
/**
* Gets the axis configuration object by loading the repository.
* The order of initialization is according the the following precedence:
@@ -261,6 +318,7 @@
* When the axis2.repository.url init parameter was present we
load services from the respective URL value of the init
parameter.<br/>
* Otherwise, try to load the services from the /WEB-INF folder
within the web application.
*/
+ @Override
public void loadServices() {
try {
String repository;
@@ -335,6 +393,7 @@
}
}
+ @Override
public void setConfigContext(ConfigurationContext configContext) {
// setting ServletContext into configctx
configContext.setProperty(HTTPConstants.MC_HTTP_SERVLETCONTEXT,
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentEngine.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentEngine.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/DeploymentEngine.java (revision
564)
@@ -20,12 +20,32 @@
package org.apache.axis2.deployment;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.lang.reflect.Method;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+import javax.xml.namespace.QName;
+import javax.xml.stream.XMLStreamException;
+
import org.apache.axiom.om.OMElement;
import org.apache.axis2.AxisFault;
+import org.apache.axis2.Constants;
import org.apache.axis2.classloader.JarFileClassLoader;
-import org.apache.axis2.Constants;
import org.apache.axis2.context.ConfigurationContext;
-import org.apache.axis2.context.ServiceContext;
import org.apache.axis2.deployment.repository.util.ArchiveReader;
import org.apache.axis2.deployment.repository.util.DeploymentFileData;
import org.apache.axis2.deployment.repository.util.WSInfo;
@@ -50,23 +70,6 @@
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import javax.xml.namespace.QName;
-import javax.xml.stream.XMLStreamException;
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.*;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-import java.lang.reflect.Method;
-import java.lang.reflect.InvocationTargetException;
-
public abstract class DeploymentEngine implements DeploymentConstants {
private static final Log log = LogFactory.getLog(DeploymentEngine.class);
@@ -314,10 +317,6 @@
populateModule(module, moduleurl);
module.setFileName(moduleurl);
addNewModule(module, axisConfig);
-
log.info(Messages.getMessage(DeploymentErrorMsgs.DEPLOYING_MODULE,
-
org.apache.axis2.util.Utils.getModuleName(module.getName(),
-
module.getVersion()),
- moduleurl.toString()));
}
}
org.apache.axis2.util.Utils.
@@ -1122,12 +1121,16 @@
}
}
- public static AxisServiceGroup loadServiceGroup(File serviceFile,
-
ConfigurationContext configCtx)
- throws AxisFault {
+ /**
+ * Modified: create ClassLoader using {@link Utils}.
+ */
+ public static AxisServiceGroup loadServiceGroup(File serviceFile,
+ ConfigurationContext configCtx) throws AxisFault {
try {
DeploymentFileData currentDeploymentFile = new
DeploymentFileData(serviceFile, null);
- DeploymentClassLoader classLoader =
Utils.createClassLoader(serviceFile);
+
+ // since we have all on classpath DeploymentClassLoader
<- getClassLoader
+ ClassLoader classLoader = Utils.createClassLoader(serviceFile);
currentDeploymentFile.setClassLoader(classLoader);
AxisServiceGroup serviceGroup = new AxisServiceGroup();
serviceGroup.setServiceGroupClassLoader(classLoader);
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/RepositoryListener.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/RepositoryListener.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/RepositoryListener.java (revision
564)
@@ -20,14 +20,6 @@
package org.apache.axis2.deployment;
-import org.apache.axis2.deployment.repository.util.DeploymentFileData;
-import org.apache.axis2.deployment.repository.util.WSInfo;
-import org.apache.axis2.deployment.repository.util.WSInfoList;
-import org.apache.axis2.deployment.util.Utils;
-import org.apache.axis2.util.Loader;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
import java.io.File;
import java.io.UnsupportedEncodingException;
import java.net.URI;
@@ -35,14 +27,22 @@
import java.net.URL;
import java.net.URLClassLoader;
import java.net.URLDecoder;
-import java.util.ArrayList;
import java.util.Enumeration;
-import java.util.Iterator;
import java.util.Map;
+import org.apache.axis2.deployment.repository.util.DeploymentFileData;
+import org.apache.axis2.deployment.repository.util.WSInfo;
+import org.apache.axis2.deployment.repository.util.WSInfoList;
+import org.apache.axis2.deployment.util.Utils;
+import org.apache.axis2.util.Loader;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
public class RepositoryListener implements DeploymentConstants {
- protected static final Log log =
LogFactory.getLog(RepositoryListener.class);
+ private static final String SECURITY_RESTRICTIONS =
"RepositoryListener: We have security restrictions to access
file:";//$NON-NLS-1$
+ protected static final Log log = LogFactory.getLog(RepositoryListener.class);
+
protected DeploymentEngine deploymentEngine;
/** Reference to a WSInfoList */
@@ -195,12 +195,19 @@
// Log this?
}
File file = new File(path.replace('/',
File.separatorChar).replace('|', ':'));
- if (file.isFile()) {
- if
(DeploymentFileData.isModuleArchiveFile(file.getName())) {
- //adding modules in the class path
- addFileToDeploy(file, deployer,
WSInfo.TYPE_MODULE);
- }
- }
+ try {
+ if (file.isFile()) {
+ if (DeploymentFileData.isModuleArchiveFile(file
+ .getName())) {
+ // adding modules in the class path
+ addFileToDeploy(file, deployer,
+ WSInfo.TYPE_MODULE);
+ }
+ }
+ } catch (SecurityException e) {
+ log.info(SECURITY_RESTRICTIONS + file.toString());
+ log.debug(e.getMessage(), e);
+ }
}
}
cl = cl.getParent();
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/ModuleDeployer.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/ModuleDeployer.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/ModuleDeployer.java (revision
564)
@@ -72,10 +72,6 @@
URL url = deploymentFileData.getFile().toURL();
metaData.setFileName(url);
DeploymentEngine.addNewModule(metaData, axisConfig);
- log.info(Messages.getMessage(DeploymentErrorMsgs.DEPLOYING_MODULE,
-
Utils.getModuleName(metaData.getName(),
-
metaData.getVersion()),
- url.toString()));
} catch (DeploymentException e) {
log.error(Messages.getMessage(DeploymentErrorMsgs.INVALID_MODULE,
deploymentFileData.getName(),
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/TempFileManager.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/TempFileManager.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/TempFileManager.java (revision
564)
@@ -18,7 +18,11 @@
*/
package org.apache.axis2.deployment.util;
-import java.io.*;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.io.PrintStream;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -41,10 +45,67 @@
* <p/>
* Thanks to Mike Pilone for this code, which was sourced from
* http://www.devx.com/Java/Article/22018/ and contributed to Apache.
+ *
+ *
+ * SB: Modified
+ * 1. Added condition: if application havn't permission read and
write to temp folder then it doesn't do it.
+ * SK: Reviewer
+ * 1. Extract track permission with help {@link SecurityManager} to method.
+ * 2. Formatted all our changes to ASG standard.
*/
public class TempFileManager {
+ /**
+ * The ending of temporary directory.
+ */
+ private static final String TMP = ".tmp"; //$NON-NLS-1$
+
+ /**
+ * The level for logs.
+ */
+ private static final String DEFAULT = "default"; //$NON-NLS-1$
+
+ /**
+ * The Java temporary directory property.
+ */
+ private static final String JAVA_IO_TMPDIR = "java.io.tmpdir"; //$NON-NLS-1$
+
+ /**
+ * Denied delete the temporary file.
+ */
+ private static final String UNABLE_TO_DELETE =
"TempFileManager::unable to delete "; //$NON-NLS-1$
+
+ /**
+ * Message about temporary directory.
+ */
+ private static final String DELETING_OLD_TEMP_DIRECTORY =
"TempFileManager::deleting old temp directory "; //$NON-NLS-1$
+
+ /**
+ * Message about security restriction.
+ */
+ private static final String EXIST_SECURITY_RESTRICTIONS =
"TempFileManager::We have security restrictions."; //$NON-NLS-1$
+
+ /**
+ * Message about security restriction.
+ */
+ private static final String EXIST_OS_RESTRICTIONS =
"TempFileManager: We have OS restrictions."; //$NON-NLS-1$
+
+ /**
+ * The prefix for the temporary directory in the system temporary directory.
+ */
+ private final static String TEMP_DIR_PREFIX = "axis2-tmp-"; //$NON-NLS-1$
+
+ /**
+ * The temporary directory to generate all files in.
+ */
+ private static File sTmpDir = null;
+
+ /**
+ * Sets true by method {@link #checkSecurityRestriction} if we have
security restrictions.
+ */
+ private static boolean securityRestrictionsPresent = false;
+
/**
* Creates a temporary file in the proper directory to allow for
cleanup after execution. This
* method delegates to {@link
File#createTempFile(java.lang.String, java.lang.String,
@@ -59,16 +120,20 @@
* @return an abstract pathname denoting a newly created empty file
* @throws IOException if a file could not be created
*/
+
@SuppressWarnings({"ResultOfMethodCallIgnored"})
public static File createTempFile(String prefix, String suffix)
throws IOException {
- // Check to see if you have already initialized a temp directory
- // for this class.
+ // Check to see if you have already initialized a temp directory
+ // for this class.
+ if (securityRestrictionsPresent) {
+ return null;
+ }
if (sTmpDir == null) {
// Initialize your temp directory. You use the java temp directory
// property, so you are sure to find the files on the next run.
- String tmpDirName = System.getProperty("java.io.tmpdir");
- File tmpDir = File.createTempFile(TEMP_DIR_PREFIX, ".tmp",
+ String tmpDirName = System.getProperty(JAVA_IO_TMPDIR);
+ File tmpDir = File.createTempFile(TEMP_DIR_PREFIX, TMP,
new File(tmpDirName));
// Delete the file if one was automatically created by the JVM.
@@ -109,9 +174,12 @@
* @param args command line arguments are currently not supported
*/
public static void main(String[] args) {
- // Although the JVM will load the class in order to
- // run the main method, this gives a little clarity to
- // what is happening and why we want the main method.
+ // Although the JVM will load the class in order to
+ // run the main method, this gives a little clarity to
+ // what is happening and why we want the main method.
+ if (securityRestrictionsPresent) {
+ return;
+ }
try {
// This will load the TempFileManager, which will
// cause the static block to execute, cleaning
@@ -133,6 +201,9 @@
*/
private static void recursiveDelete(File rootDir)
throws IOException {
+ if (securityRestrictionsPresent) {
+ return;
+ }
// Select all the files
File[] files = rootDir.listFiles();
for (File file : files) {
@@ -157,67 +228,74 @@
}
}
+ /**
+ * Static block used to clean up any old temporary directories found
-- the JVM
+ * will run this block when a class loader loads the class.
+ */
+ static {
+ // Clean up any old temporary directories by listing
+ // all of the files, using a filter that will
+ // return only directories that start with your
+ // prefix.
+ FileFilter tmpDirFilter = new FileFilter() {
+ public boolean accept(File pathname) {
+ return (pathname.isDirectory() && pathname.getName()
+ .startsWith(TEMP_DIR_PREFIX));
+ }
+ };
- /** The prefix for the temp directory in the system temp directory */
- private final static String TEMP_DIR_PREFIX = "axis2-tmp-";
+ // Get the system temporary directory and filter the files.
+ String tmpDirName = System.getProperty(JAVA_IO_TMPDIR);
+ // Track if we have SecurityRestrictions
+ checkSecurityRestriction(tmpDirName);
- /** The temp directory to generate all files in */
- private static File sTmpDir = null;
+ if (!securityRestrictionsPresent) {
+ File tmpDir = new File(tmpDirName);
+ File[] tmpFiles = tmpDir.listFiles(tmpDirFilter);
- /**
- * Static block used to clean up any old temp directories found -- the JVM
- * will run this block when a class loader loads the class.
- */
- static {
- // Clean up any old temp directories by listing
- // all of the files, using a filter that will
- // return only directories that start with your
- // prefix.
- FileFilter tmpDirFilter =
- new FileFilter() {
- public boolean accept(File pathname) {
- return (pathname.isDirectory() &&
-
pathname.getName().startsWith(TEMP_DIR_PREFIX));
- }
- };
+ // Find all the files that do not have a lock by
+ // checking if the lock file exists.
+ for (File tmpFile : tmpFiles) {
+ // Create a file to represent the lock and test.
+ File lockFile = new File(tmpFile.getParent(), tmpFile.getName()
+ + ".lck"); //$NON-NLS-1$
+ if (!lockFile.exists()) {
+ // Delete the contents of the directory since
+ // it is no longer locked.
+ Logger.getLogger(DEFAULT).log(
+ Level.FINE, DELETING_OLD_TEMP_DIRECTORY + tmpFile);
- // Get the system temp directory and filter the files.
- String tmpDirName = System.getProperty("java.io.tmpdir");
- File tmpDir = new File(tmpDirName);
- File[] tmpFiles = tmpDir.listFiles(tmpDirFilter);
+ try {
+ recursiveDelete(tmpFile);
+ } catch (IOException ex) {
+ // You log at a fine level since not being able to
+ // delete the temp directory should not stop the
+ // application from performing correctly. However, if
+ // the application generates a lot of temp files, this
+ // could become a disk space problem and the level
+ // should be raised.
+ Logger.getLogger(DEFAULT).log(Level.INFO,
+ UNABLE_TO_DELETE + tmpFile.getAbsolutePath());
- // Find all the files that do not have a lock by
- // checking if the lock file exists.
- for (File tmpFile : tmpFiles) {
- // Create a file to represent the lock and test.
- File lockFile = new File(tmpFile.getParent(),
tmpFile.getName() + ".lck");
- if (!lockFile.exists()) {
- // Delete the contents of the directory since
- // it is no longer locked.
- Logger.getLogger("default").log(Level.FINE,
-
"TempFileManager::deleting old temp directory " +
- tmpFile);
+ // Print the exception.
+ ByteArrayOutputStream ostream = new ByteArrayOutputStream();
+ ex.printStackTrace(new PrintStream(ostream));
- try {
- recursiveDelete(tmpFile);
- }
- catch (IOException ex) {
- // You log at a fine level since not being able to delete
- // the temp directory should not stop the application
- // from performing correctly. However, if the application
- // generates a lot of temp files, this could become
- // a disk space problem and the level should be raised.
- Logger.getLogger("default").log(Level.INFO,
-
"TempFileManager::unable to delete " +
- tmpFile.getAbsolutePath());
+ Logger.getLogger(DEFAULT).log(Level.FINE,
+ ostream.toString());
+ }
+ }
+ }
+ }
+ }
- // Print the exception.
- ByteArrayOutputStream ostream = new
ByteArrayOutputStream();
- ex.printStackTrace(new PrintStream(ostream));
-
- Logger.getLogger("default").log(Level.FINE,
ostream.toString());
- }
- }
- }
- }
+ /**
+ * Method track security restriction and if it's present then method
sets <code>{@link #securityRestrictionsPresent}=true</code>.
+ *
+ * @param tmpDirName
+ * the temporary directory.
+ */
+ private static void checkSecurityRestriction(String tmpDirName) {
+ securityRestrictionsPresent =
!org.apache.axis2.util.Utils.isEnabledAccessToFolder(tmpDirName);
+ }
}
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/Utils.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/Utils.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/deployment/util/Utils.java (revision
564)
@@ -19,21 +19,74 @@
package org.apache.axis2.deployment.util;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.net.URLDecoder;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Stack;
+import java.util.StringTokenizer;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+import javax.jws.WebMethod;
+import javax.jws.WebService;
+import javax.xml.namespace.QName;
+import javax.xml.stream.FactoryConfigurationError;
+import javax.xml.stream.XMLStreamException;
+
import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.om.OMElement;
import org.apache.axiom.om.OMFactory;
import org.apache.axiom.soap.SOAP11Constants;
import org.apache.axiom.soap.SOAP12Constants;
import org.apache.axis2.AxisFault;
+import org.apache.axis2.Constants;
import org.apache.axis2.classloader.JarFileClassLoader;
-import org.apache.axis2.Constants;
import org.apache.axis2.context.ConfigurationContext;
-import org.apache.axis2.deployment.DeploymentClassLoader;
import org.apache.axis2.deployment.DeploymentConstants;
import org.apache.axis2.deployment.DeploymentException;
import org.apache.axis2.deployment.repository.util.ArchiveReader;
import org.apache.axis2.deployment.repository.util.DeploymentFileData;
-import org.apache.axis2.description.*;
+import org.apache.axis2.description.AxisBinding;
+import org.apache.axis2.description.AxisBindingMessage;
+import org.apache.axis2.description.AxisBindingOperation;
+import org.apache.axis2.description.AxisEndpoint;
+import org.apache.axis2.description.AxisMessage;
+import org.apache.axis2.description.AxisModule;
+import org.apache.axis2.description.AxisOperation;
+import org.apache.axis2.description.AxisOperationFactory;
+import org.apache.axis2.description.AxisService;
+import org.apache.axis2.description.AxisServiceGroup;
+import org.apache.axis2.description.Flow;
+import org.apache.axis2.description.HandlerDescription;
+import org.apache.axis2.description.Parameter;
+import org.apache.axis2.description.TransportInDescription;
+import org.apache.axis2.description.WSDL2Constants;
import org.apache.axis2.description.java2wsdl.DefaultSchemaGenerator;
import org.apache.axis2.description.java2wsdl.DocLitBareSchemaGenerator;
import org.apache.axis2.description.java2wsdl.Java2WSDLConstants;
@@ -51,29 +104,20 @@
import org.apache.neethi.PolicyComponent;
import org.apache.ws.commons.schema.utils.NamespaceMap;
-import javax.jws.WebMethod;
-import javax.jws.WebService;
-import javax.xml.namespace.QName;
-import javax.xml.stream.FactoryConfigurationError;
-import javax.xml.stream.XMLStreamException;
-import java.io.*;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.lang.reflect.Modifier;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.net.URLClassLoader;
-import java.net.URLDecoder;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.*;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-
+/**
+ * SB: Modified
+ * 1. Constructions new URLClassLoader replaced with URLClassLoader.newInstance
+ * 2. Constructions new ClassLoader replaced with ClassLoader.newInstance
+ * SK: Reviewer
+ * 1. Formatted all our changes to ASG standard.
+ *
+ */
public class Utils {
+ private static final String LIB_LOW = "lib"; //$NON-NLS-1$
+
+ private static final String LIB_HIGH = "Lib"; //$NON-NLS-1$
+
public static String defaultEncoding = new
OutputStreamWriter(System.out).getEncoding();
private static Log log = LogFactory.getLog(Utils.class);
@@ -304,58 +348,80 @@
return f;
}
- public static ClassLoader getClassLoader(ClassLoader parent, String path)
- throws DeploymentException {
- return getClassLoader(parent, new File(path));
- }
+ /**
+ * Get a ClassLoader which contains a classpath of a) the passed directory
+ * and b) any jar files inside the "lib/" or "Lib/" subdirectory of the
+ * passed directory.
+ *
+ * @param parent
+ * parent ClassLoader which will be the parent of the result of
+ * this method
+ * @param file
+ * a File which must be a directory for this to be useful
+ *
+ * @return return the {@link ClassLoader}.
+ * @throws DeploymentException
+ */
+ public static ClassLoader getClassLoader(ClassLoader parent, String path)
+ throws DeploymentException {
+ return getClassLoader(parent, new File(path));
+ }
- /**
- * Get a ClassLoader which contains a classpath of a) the passed
directory and b) any jar files
- * inside the "lib/" or "Lib/" subdirectory of the passed directory.
- *
- * @param parent parent ClassLoader which will be the parent of
the result of this method
- * @param file a File which must be a directory for this to be useful
- * @return a new ClassLoader pointing to both the passed dir and
jar files under lib/
- * @throws DeploymentException if problems occur
- */
- public static ClassLoader getClassLoader(final ClassLoader
parent, File file)
- throws DeploymentException {
- URLClassLoader classLoader;
+ /**
+ * Get a ClassLoader which contains a classpath of a) the passed directory
+ * and b) any jar files inside the "lib/" or "Lib/" subdirectory of the
+ * passed directory.
+ *
+ * @param parent
+ * parent ClassLoader which will be the parent of the result of
+ * this method
+ * @param file
+ * a File which must be a directory for this to be useful
+ * @return a new ClassLoader pointing to both the passed dir and jar files
+ * under lib/
+ * @throws DeploymentException
+ * if problems occur
+ */
+ @SuppressWarnings({ "unchecked", "rawtypes" })
+ public static ClassLoader getClassLoader(final ClassLoader parent, File file)
+ throws DeploymentException {
+ URLClassLoader classLoader;
- if (file == null)
- return null; // Shouldn't this just return the parent?
+ if (file == null)
+ return null; // Shouldn't this just return the parent?
- try {
- ArrayList urls = new ArrayList();
- urls.add(file.toURL());
+ try {
+ ArrayList urls = new ArrayList();
+ urls.add(file.toURL());
- // lower case directory name
- File libfiles = new File(file, "lib");
- if (!addFiles(urls, libfiles)) {
- // upper case directory name
- libfiles = new File(file, "Lib");
- addFiles(urls, libfiles);
- }
+ // lower case directory name
+ File libfiles = new File(file, LIB_LOW);
+ if (!addFiles(urls, libfiles)) {
+ // upper case directory name
+ libfiles = new File(file, LIB_HIGH);
+ addFiles(urls, libfiles);
+ }
- final URL urllist[] = new URL[urls.size()];
- for (int i = 0; i < urls.size(); i++) {
- urllist[i] = (URL)urls.get(i);
- }
- classLoader = (URLClassLoader)AccessController
- .doPrivileged(new PrivilegedAction() {
- public Object run() {
- if (useJarFileClassLoader()) {
- return new JarFileClassLoader(urllist, parent);
- } else {
- return new URLClassLoader(urllist, parent);
- }
- }
- });
- return classLoader;
- } catch (MalformedURLException e) {
- throw new DeploymentException(e);
- }
- }
+ final URL urllist[] = new URL[urls.size()];
+ for (int i = 0; i < urls.size(); i++) {
+ urllist[i] = (URL) urls.get(i);
+ }
+ PrivilegedAction action = new PrivilegedAction() {
+ public Object run() {
+ if (useJarFileClassLoader()) {
+ return JarFileClassLoader.newInstance(urllist, parent);
+ } else {
+ return URLClassLoader.newInstance(urllist, parent);
+ }
+ }
+ };
+ classLoader = (URLClassLoader) AccessController
+ .doPrivileged(action);
+ return classLoader;
+ } catch (MalformedURLException e) {
+ throw new DeploymentException(e);
+ }
+ }
private static boolean useJarFileClassLoader() {
// The JarFileClassLoader was created to address a locking
problem seen only on Windows platforms.
@@ -845,18 +911,29 @@
excludeList.add("shutDown");
}
- public static DeploymentClassLoader createClassLoader(File serviceFile)
- throws MalformedURLException {
- ClassLoader contextClassLoader =
- (ClassLoader)org.apache.axis2.java.security.AccessController
- .doPrivileged(new PrivilegedAction() {
- public Object run() {
- return
Thread.currentThread().getContextClassLoader();
- }
- });
- return createDeploymentClassLoader(new URL[]{serviceFile.toURL()},
- contextClassLoader, new
ArrayList());
- }
+ /**
+ * Create ClassLoader using service file.
+ *
+ * Reviewer SK: 1. formated code; 2. comments.
+ *
+ * @param serviceFile
+ * the service file.
+ *
+ * @return return {@link ClassLoader}.
+ * @throws MalformedURLException
+ * if problem occur.
+ */
+ public static ClassLoader createClassLoader(File serviceFile)
+ throws MalformedURLException {
+ ClassLoader contextClassLoader = (ClassLoader)
org.apache.axis2.java.security.AccessController
+ .doPrivileged(new PrivilegedAction() {
+ public Object run() {
+ return Thread.currentThread().getContextClassLoader();
+ }
+ });
+ return createInstanceClassLoader(new URL[] { serviceFile.toURL() },
+ contextClassLoader, new ArrayList());
+ }
public static ClassLoader createClassLoader(ArrayList urls,
ClassLoader serviceClassLoader,
@@ -869,7 +946,7 @@
urls.remove(0);
urls.addAll(0, Arrays.asList(urls1));
URL[] urls2 = (URL[])urls.toArray(new URL[urls.size()]);
- return createDeploymentClassLoader(urls2, serviceClassLoader,
+ return createInstanceClassLoader(urls2, serviceClassLoader,
null);
} catch (Exception e) {
log
@@ -881,7 +958,7 @@
}
List embedded_jars = Utils.findLibJars(url);
URL[] urls2 = (URL[])urls.toArray(new URL[urls.size()]);
- return createDeploymentClassLoader(urls2, serviceClassLoader,
+ return createInstanceClassLoader(urls2, serviceClassLoader,
embedded_jars);
}
@@ -897,7 +974,7 @@
if (extractJars) {
try {
URL[] urls1 = Utils.getURLsForAllJars(urls[0], tmpDir);
- return createDeploymentClassLoader(urls1, serviceClassLoader,
+ return createInstanceClassLoader(urls1, serviceClassLoader,
null);
} catch (Exception e) {
log
@@ -908,21 +985,27 @@
}
}
List embedded_jars = Utils.findLibJars(urls[0]);
- return createDeploymentClassLoader(urls, serviceClassLoader,
+ return createInstanceClassLoader(urls, serviceClassLoader,
embedded_jars);
}
- private static DeploymentClassLoader createDeploymentClassLoader(
- final URL[] urls, final ClassLoader serviceClassLoader,
- final List embeddedJars) {
- return (DeploymentClassLoader)AccessController
- .doPrivileged(new PrivilegedAction() {
- public Object run() {
- return new DeploymentClassLoader(urls, embeddedJars,
- serviceClassLoader);
- }
- });
- }
+ /**
+ * Create new instance of the ClassLoader.
+ *
+ * Reviewer: SK 1. Formatted to ASG standard. 2. Removed commented code.
+ * 3. Added comments.
+ *
+ * @param urls
+ * the URLs to search resources.
+ * @param serviceClassLoader
+ * the parent class loader for delegation.
+ *
+ * @return return {@link ClassLoader}.
+ */
+ private static ClassLoader createInstanceClassLoader(final URL[] urls,
+ final ClassLoader serviceClassLoader, final List embeddedJars) {
+ return URLClassLoader.newInstance(urls, serviceClassLoader);
+ }
/**
* This method is to process bean exclude parameter and the XML
format of that would be
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/context/ConfigurationContext.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/context/ConfigurationContext.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/context/ConfigurationContext.java (revision
564)
@@ -35,6 +35,7 @@
import org.apache.axis2.engine.ListenerManager;
import org.apache.axis2.i18n.Messages;
import org.apache.axis2.java.security.AccessController;
+import org.apache.axis2.util.Utils;
import org.apache.axis2.util.JavaUtils;
import org.apache.axis2.util.threadpool.ThreadFactory;
import org.apache.axis2.util.threadpool.ThreadPool;
@@ -63,6 +64,9 @@
* to be used by two Axis2 instances and most Axis2 wide
configurations can changed by setting name
* value pairs of the configurationContext. This hold all
OperationContexts, ServiceGroups,
* Sessions, and ListenerManager.
+ *
+ * SB: Modified
+ * 1. In method cleanupTemp we check read/write access to temp folder
before cleaning
*/
public class ConfigurationContext extends AbstractContext {
@@ -746,25 +750,28 @@
cleanupTemp();
}
- /**
- * This include all the major changes we have done from 1.2
release to 1.3 release. This will
- * include API changes , class deprecating etc etc.
- */
- private void cleanupTemp() {
- File tempFile = (File)axisConfiguration.getParameterValue(
- Constants.Configuration.ARTIFACTS_TEMP_DIR);
- if (tempFile == null) {
- String property = (String)AccessController.doPrivileged(
- new PrivilegedAction<String>() {
- public String run() {
- return System.getProperty("java.io.tmpdir");
- }
- }
- );
- tempFile = new File(property, "_axis2");
- }
- deleteTempFiles(tempFile);
- }
+ /**
+ * This include all the major changes we have done from 1.2 release to 1.3
+ * release. This will include API changes , class deprecating etc etc.
+ *
+ * SB : I have added check read/write to temp folder
+ */
+ private void cleanupTemp() {
+ File tempFile = (File) axisConfiguration
+ .getParameterValue(Constants.Configuration.ARTIFACTS_TEMP_DIR);
+ if (tempFile == null) {
+ String property = (String) AccessController
+ .doPrivileged(new PrivilegedAction<String>() {
+ public String run() {
+ return System.getProperty("java.io.tmpdir");
+ }
+ });
+ tempFile = new File(property, "_axis2");
+ }
+ if (Utils.isEnabledAccessToFolder(tempFile.getAbsolutePath())) {
+ deleteTempFiles(tempFile);
+ }
+ }
private void deleteTempFiles(final File dir) {
Boolean isDir = (Boolean)AccessController.doPrivileged(
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/receivers/AbstractMessageReceiver.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/receivers/AbstractMessageReceiver.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/receivers/AbstractMessageReceiver.java (revision
564)
@@ -20,6 +20,13 @@
package org.apache.axis2.receivers;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedExceptionAction;
+
import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.soap.SOAP11Constants;
import org.apache.axiom.soap.SOAP12Constants;
@@ -47,13 +54,6 @@
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import java.lang.reflect.Method;
-import java.lang.reflect.InvocationTargetException;
-import java.net.URL;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedExceptionAction;
-
public abstract class AbstractMessageReceiver implements MessageReceiver {
protected static final Log log =
LogFactory.getLog(AbstractMessageReceiver.class);
@@ -81,34 +81,37 @@
*/
protected abstract void invokeBusinessLogic(MessageContext
messageCtx) throws AxisFault;
- /**
- *
- * @param messageCtx active MessageContext
- * @throws AxisFault if a problem occurred
- */
- public void receive(final MessageContext messageCtx) throws AxisFault {
- if (messageCtx.isPropertyTrue(DO_ASYNC)
- || ((messageCtx.getParameter(DO_ASYNC) != null) &&
-
JavaUtils.isTrueExplicitly(messageCtx.getParameter(DO_ASYNC).getValue())))
{
+ /**
+ * Setup to receive messages.
+ *
+ * @param messageCtx
+ * active MessageContext.
+ * @throws AxisFault
+ * if a problem occurred.
+ */
+ public void receive(final MessageContext messageCtx) throws AxisFault {
+ if (messageCtx.isPropertyTrue(DO_ASYNC)
+ || ((messageCtx.getParameter(DO_ASYNC) != null) && JavaUtils
+ .isTrueExplicitly(messageCtx.getParameter(DO_ASYNC)
+ .getValue()))) {
- String mep = messageCtx.getAxisOperation()
- .getMessageExchangePattern();
+ String mep = messageCtx.getAxisOperation()
+ .getMessageExchangePattern();
EndpointReference replyTo = messageCtx.getReplyTo();
// In order to invoke the service in the ASYNC mode, the request
// should contain ReplyTo header if the MEP of the service is not
// InOnly type
if ((!WSDLUtil.isOutputPresentForMEP(mep))
- || (replyTo != null && !replyTo.hasAnonymousAddress())) {
+ || (replyTo != null && !replyTo.hasAnonymousAddress())) {
AsyncMessageReceiverWorker worker = new AsyncMessageReceiverWorker(
- messageCtx);
+ messageCtx);
messageCtx.getEnvelope().build();
- messageCtx.getConfigurationContext().getThreadPool().execute(
- worker);
+ messageCtx.getConfigurationContext().getThreadPool()
+ .execute(worker);
return;
}
}
-
ThreadContextDescriptor tc = setThreadContext(messageCtx);
try {
invokeBusinessLogic(messageCtx);
@@ -122,7 +125,7 @@
throw fault;
}
} finally {
- restoreThreadContext(tc);
+ //restoreThreadContext(tc);
}
}
@@ -138,7 +141,7 @@
*/
protected ThreadContextDescriptor setThreadContext(final
MessageContext msgContext) {
ThreadContextDescriptor tc = new ThreadContextDescriptor();
- tc.oldMessageContext = (MessageContext)
MessageContext.currentMessageContext.get();
+ tc.oldMessageContext = MessageContext.currentMessageContext.get();
final ClassLoader contextClassLoader = getContextClassLoader_doPriv();
tc.oldClassLoader = contextClassLoader;
Index: D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/util/Utils.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/util/Utils.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/kernel/src/org/apache/axis2/util/Utils.java (revision
564)
@@ -15,6 +15,9 @@
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
+ *
+ * Changes :
+ * 1. SB : isEnabledAccessToFolder has been added to check read/write access
*/
@@ -335,7 +338,7 @@
public static String getModuleName(String moduleName, String
moduleVersion) {
if (moduleVersion != null && moduleVersion.length() != 0) {
moduleName = moduleName + "-" + moduleVersion;
- }
+ }
return moduleName;
}
@@ -635,4 +638,31 @@
private static boolean isIP(String hostAddress) {
return hostAddress.split("[.]").length == 4;
}
+
+ /**
+ * Checks if we have read and write access to <code>dirName</code>.
+ *
+ * @param dirName
+ * name of the directory to which we checking access
+ * @return true if we have no security restrictions accessing to
+ * <code>dirName</code>
+ * @author sbelei
+ */
+ public static boolean isEnabledAccessToFolder(String dirName) {
+ SecurityManager sm = System.getSecurityManager();
+ File dirToCheck = new File(dirName);
+ Boolean isAccessEnabled = true;
+ try {
+ if (!(dirToCheck.canRead() && dirToCheck.canWrite())) {
+ isAccessEnabled = false;
+ }
+ if (sm != null) {
+ sm.checkRead(dirName);
+ sm.checkWrite(dirName);
+ }
+ } catch (SecurityException e) {
+ isAccessEnabled = false;
+ }
+ return isAccessEnabled;
+ }
}
Index: D:/.../projects/axis2-1.5/modules/jaxws/src/org/apache/axis2/jaxws/framework/JAXWSDeployer.java
===================================================================
--- D:/.../projects/axis2-1.5/modules/jaxws/src/org/apache/axis2/jaxws/framework/JAXWSDeployer.java (revision
302)
+++ D:/.../projects/axis2-1.5/modules/jaxws/src/org/apache/axis2/jaxws/framework/JAXWSDeployer.java (revision
564)
@@ -19,6 +19,24 @@
package org.apache.axis2.jaxws.framework;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.net.URL;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+import java.util.jar.JarInputStream;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+import javax.jws.WebService;
+import javax.xml.namespace.QName;
+import javax.xml.ws.WebServiceProvider;
+
import org.apache.axis2.AxisFault;
import org.apache.axis2.Constants;
import org.apache.axis2.context.ConfigurationContext;
@@ -45,31 +63,46 @@
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import javax.jws.WebService;
-import javax.xml.namespace.QName;
-import javax.xml.ws.WebServiceProvider;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.net.URL;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Iterator;
-import java.util.List;
-import java.util.jar.JarInputStream;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-
-/*
+/**
* JAXWSDeployer is a custom deployer modeled after the POJODeployer.
Its purpose
- * is to deploy .wars and expanded .war directories
+ * is to deploy .wars and expanded .war directories.
+ *
+ * SB: Modified
+ * 1. Normaly class swiches classloader for current thread.
+ * If we have no setContextClassLoader permission, class will not do it.
+ * SK: Reviewer
+ * 1. Refactored deployServicesInWARClassPath() method.
+ * 2. Formatted all our changes to ASG standard.
*/
public class JAXWSDeployer implements Deployer {
- private static Log log = LogFactory.getLog(JAXWSDeployer.class);
+ /**
+ * Message for wrong deploying.
+ */
+ private static final String DEPLOYING_EXCEPTION =
"deployingexception"; //$NON-NLS-1$
+ /**
+ * The name of <b>setContextClassLoader</b> permission.
+ */
+ private static final String SET_CONTEXT_CLASS_LOADER =
"setContextClassLoader"; //$NON-NLS-1$
+
+ /**
+ * The path to /WEB-INF/classes.
+ */
+ private static final String WEB_INF_CLASSES = "/WEB-INF/classes/";
//$NON-NLS-1$
+
+ /**
+ * The JAXWS group.
+ */
+ private static final String JAXWS_BUILTIN = "JAXWS-Builtin"; //$NON-NLS-1$
+
+ /**
+ * Security restriction message.
+ */
+ private static final String SECURITY_RESTRICTION_MESSAGE = "We have
security restriction on setContextClassLoader"; //$NON-NLS-1$
+
+ private static Log log = LogFactory.getLog(JAXWSDeployer.class);
+
protected ConfigurationContext configCtx;
protected AxisConfiguration axisConfig;
@@ -80,41 +113,82 @@
deployServicesInWARClassPath();
}//Will process the file and add that to axisConfig
- protected void deployServicesInWARClassPath() {
- String dir = DeploymentEngine.getWebLocationString();
- if (dir != null) {
- File file = new File(dir + "/WEB-INF/classes/");
- URL repository = axisConfig.getRepository();
- if (!file.isDirectory() || repository == null)
- return;
- ArrayList classList = getClassesInWebInfDirectory(file);
- ClassLoader threadClassLoader = null;
- try {
- threadClassLoader =
Thread.currentThread().getContextClassLoader();
- ArrayList urls = new ArrayList();
- urls.add(repository);
- String webLocation = DeploymentEngine.getWebLocationString();
- if (webLocation != null) {
- urls.add(new File(webLocation).toURL());
- }
- ClassLoader classLoader = Utils.createClassLoader(
- urls,
- axisConfig.getSystemClassLoader(),
- true,
- (File) axisConfig.
-
getParameterValue(Constants.Configuration.ARTIFACTS_TEMP_DIR));
- Thread.currentThread().setContextClassLoader(classLoader);
- deployClasses("JAXWS-Builtin", file.toURL(),
Thread.currentThread().getContextClassLoader(), classList);
- } catch (Exception e) {
- log.info(Messages.getMessage("deployingexception",
e.getMessage()), e);
- } finally {
- if (threadClassLoader != null) {
-
Thread.currentThread().setContextClassLoader(threadClassLoader);
- }
- }
- }
- }
+ /**
+ * Deploy services in WAR Class Path.
+ */
+ protected void deployServicesInWARClassPath() {
+ String dir = DeploymentEngine.getWebLocationString();
+ if (dir != null) {
+ File file = new File(dir + WEB_INF_CLASSES);
+ URL repository = axisConfig.getRepository();
+ if (!file.isDirectory() || repository == null) {
+ return;
+ }
+
+ ArrayList classList = getClassesInWebInfDirectory(file);
+ ClassLoader threadClassLoader = null;
+ try {
+ threadClassLoader = Thread.currentThread()
+ .getContextClassLoader();
+ ArrayList urls = new ArrayList();
+ urls.add(repository);
+ String webLocation = DeploymentEngine.getWebLocationString();
+ if (webLocation != null) {
+ urls.add(new File(webLocation).toURL());
+ }
+ ClassLoader classLoader = Utils
+ .createClassLoader(
+ urls,
+ axisConfig.getSystemClassLoader(),
+ true,
+ (File) axisConfig
+
.getParameterValue(Constants.Configuration.ARTIFACTS_TEMP_DIR));
+ setThreadClassLoader(classLoader);
+ deployClasses(JAXWS_BUILTIN, file.toURL(), Thread
+ .currentThread().getContextClassLoader(), classList);
+ }catch (Exception e) {
+ log.info(Messages.getMessage(DEPLOYING_EXCEPTION,
+ e.getMessage()), e);
+ }
+ setThreadClassLoader(threadClassLoader);
+ }
+ }
+
+ /**
+ * Check {@link ClassLoader}. If it not equal <code>null</code> then sets
+ * ClassLoader to currentThread. This using for resolving issues with JBoss
+ * web server.
+ *
+ * @param threadClassLoader
+ * the {@link ClassLoader}.
+ */
+ private void setThreadClassLoader(ClassLoader threadClassLoader) {
+ try {
+ if (threadClassLoader != null) {
+ checkSetContextClassLoaderPermissions();
+ Thread.currentThread().setContextClassLoader(threadClassLoader);
+ }
+ } catch (SecurityException e) {
+ log.info(SECURITY_RESTRICTION_MESSAGE);
+ }
+ }
+
+ /**
+ * Check setContextClassLoader permissions using {@link SecurityManager}.
+ */
+ private void checkSetContextClassLoaderPermissions() {
+ SecurityManager security = System.getSecurityManager();
+ try {
+ if (security != null) {
+ security.checkPermission(new RuntimePermission(
+ SET_CONTEXT_CLASS_LOADER));
+ }
+ } catch (SecurityException e) {
+ log.info(SECURITY_RESTRICTION_MESSAGE);
+ }
+ }
+
protected ArrayList getClassesInWebInfDirectory(File file) {
String filePath = file.getAbsolutePath();
Collection files = FileUtils.listFiles(file, new
String[]{"class"}, true);
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org