HHH-10435 HHH-12542 HHH-12189 (5.1)

hibernate-core/src/main/java/org/hibernate/boot/cfgxml/internal/ConfigLoader.java

@@ -12,6 +12,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.Properties;
 
 import org.hibernate.boot.cfgxml.spi.LoadedConfig;
@@ -47,28 +49,35 @@ public ConfigLoader(BootstrapServiceRegistry bootstrapServiceRegistry) {
 		this.bootstrapServiceRegistry = bootstrapServiceRegistry;
 	}
 
-	public LoadedConfig loadConfigXmlResource(String cfgXmlResourceName) {
-		final InputStream stream = bootstrapServiceRegistry.getService( ClassLoaderService.class ).locateResourceStream( cfgXmlResourceName );
-		if ( stream == null ) {
-			throw new ConfigurationException( "Could not locate cfg.xml resource [" + cfgXmlResourceName + "]" );
-		}
-
-		try {
-			final JaxbCfgHibernateConfiguration jaxbCfg = jaxbProcessorHolder.getValue().unmarshal(
-					stream,
-					new Origin( SourceType.RESOURCE, cfgXmlResourceName )
-			);
+	public LoadedConfig loadConfigXmlResource(final String cfgXmlResourceName) {
+		final PrivilegedAction<JaxbCfgHibernateConfiguration> action = new PrivilegedAction<JaxbCfgHibernateConfiguration>() {
+			@Override
+			public JaxbCfgHibernateConfiguration run() {
+				final InputStream stream = bootstrapServiceRegistry.getService( ClassLoaderService.class ).locateResourceStream( cfgXmlResourceName );
+				if ( stream == null ) {
+					throw new ConfigurationException( "Could not locate cfg.xml resource [" + cfgXmlResourceName + "]" );
+				}
 
-			return LoadedConfig.consume( jaxbCfg );
-		}
-		finally {
-			try {
-				stream.close();
-			}
-			catch (IOException e) {
-				log.debug( "Unable to close cfg.xml resource stream", e );
+				try {
+					return jaxbProcessorHolder.getValue().unmarshal(
+							stream,
+							new Origin( SourceType.RESOURCE, cfgXmlResourceName )
+					);
+				}
+				finally {
+					try {
+						stream.close();
+					}
+					catch ( IOException e ) {
+						log.debug( "Unable to close cfg.xml resource stream", e );
+					}
+				}
 			}
-		}
+		};
+
+		return LoadedConfig.consume(
+				System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run()
+		);
 	}
 
 	public LoadedConfig loadConfigXmlFile(File cfgXmlFile) {

hibernate-core/src/main/java/org/hibernate/boot/jaxb/internal/AbstractBinder.java

@@ -7,6 +7,9 @@
 package org.hibernate.boot.jaxb.internal;
 
 import java.io.InputStream;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
 import javax.xml.bind.Unmarshaller;
@@ -96,10 +99,17 @@ protected XMLEventReader createReader(Source source, Origin origin) {
 		}
 	}
 
-	private Binding doBind(XMLEventReader eventReader, Origin origin) {
+	private Binding doBind(final XMLEventReader eventReader, final Origin origin) {
 		try {
-			final StartElement rootElementStartEvent = seekRootElementStartEvent( eventReader, origin );
-			return doBind( eventReader, rootElementStartEvent, origin );
+			final PrivilegedAction<Binding> action = new PrivilegedAction<Binding>() {
+				@Override
+				public Binding run() {
+					final StartElement rootElementStartEvent = seekRootElementStartEvent( eventReader, origin );
+					return doBind( eventReader, rootElementStartEvent, origin );
+				}
+			};
+
+			return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 		}
 		finally {
 			try {

hibernate-core/src/main/java/org/hibernate/boot/registry/classloading/internal/ClassLoaderServiceImpl.java

@@ -11,6 +11,8 @@
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -79,19 +81,27 @@ public ClassLoaderServiceImpl(Collection<ClassLoader> providedClassLoaders) {
 		// then the Hibernate class loader
 		orderedClassLoaderSet.add( ClassLoaderServiceImpl.class.getClassLoader() );
 
-		// then the TCCL, if one...
-		final ClassLoader tccl = locateTCCL();
-		if ( tccl != null ) {
-			orderedClassLoaderSet.add( tccl );
-		}
-		// finally the system classloader
-		final ClassLoader sysClassLoader = locateSystemClassLoader();
-		if ( sysClassLoader != null ) {
-			orderedClassLoaderSet.add( sysClassLoader );
-		}
-
 		// now build the aggregated class loader...
-		this.aggregatedClassLoader = new AggregatedClassLoader( orderedClassLoaderSet );
+		final PrivilegedAction<AggregatedClassLoader> action = new PrivilegedAction<AggregatedClassLoader>() {
+			@Override
+			public AggregatedClassLoader run() {
+				// then the TCCL, if one...
+				final ClassLoader tccl = locateTCCL();
+				if ( tccl != null ) {
+					orderedClassLoaderSet.add( tccl );
+				}
+				// finally the system classloader
+				final ClassLoader sysClassLoader = locateSystemClassLoader();
+				if ( sysClassLoader != null ) {
+					orderedClassLoaderSet.add( sysClassLoader );
+				}
+				return new AggregatedClassLoader( orderedClassLoaderSet );
+			}
+		};
+
+		this.aggregatedClassLoader = System.getSecurityManager() != null
+				? AccessController.doPrivileged( action )
+				: action.run();
 	}
 
 	/**
@@ -221,50 +231,63 @@ protected Class<?> findClass(String name) throws ClassNotFoundException {
 
 	@Override
 	@SuppressWarnings({"unchecked"})
-	public <T> Class<T> classForName(String className) {
-		try {
-			return (Class<T>) Class.forName( className, true, getAggregatedClassLoader() );
-		}
-		catch (Exception e) {
-			throw new ClassLoadingException( "Unable to load class [" + className + "]", e );
-		}
-		catch (LinkageError e) {
-			throw new ClassLoadingException( "Unable to load class [" + className + "]", e );
-		}
+	public <T> Class<T> classForName(final String className) {
+		final PrivilegedAction<Class<T>> action = new PrivilegedAction<Class<T>>() {
+			@Override
+			public Class<T> run() {
+				try {
+					return (Class<T>) Class.forName( className, true, getAggregatedClassLoader() );
+				}
+				catch (Exception e) {
+					throw new ClassLoadingException( "Unable to load class [" + className + "]", e );
+				}
+				catch (LinkageError e) {
+					throw new ClassLoadingException( "Unable to load class [" + className + "]", e );
+				}
+			}
+		};
+
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 
 	@Override
-	public URL locateResource(String name) {
-		// first we try name as a URL
-		try {
-			return new URL( name );
-		}
-		catch (Exception ignore) {
-		}
-
-		try {
-			final URL url = getAggregatedClassLoader().getResource( name );
-			if ( url != null ) {
-				return url;
-			}
-		}
-		catch (Exception ignore) {
-		}
+	public URL locateResource(final String name) {
+		final PrivilegedAction<URL> action = new PrivilegedAction<URL>() {
+			@Override
+			public URL run() {
+				try {
+					return new URL( name );
+				}
+				catch (Exception ignore) {
+				}
 
-		if ( name.startsWith( "/" ) ) {
-			name = name.substring( 1 );
+				try {
+					final URL url = getAggregatedClassLoader().getResource( name );
+					if ( url != null ) {
+						return url;
+					}
+				}
+				catch (Exception ignore) {
+				}
 
-			try {
-				final URL url = getAggregatedClassLoader().getResource( name );
-				if ( url != null ) {
-					return url;
+				if ( name.startsWith( "/" ) ) {
+					final String resourceName = name.substring( 1 );
+
+					try {
+						final URL url = getAggregatedClassLoader().getResource( resourceName );
+						if ( url != null ) {
+							return url;
+						}
+					}
+					catch (Exception ignore) {
+					}
 				}
+
+				return null;
 			}
-			catch (Exception ignore) {
-			}
-		}
+		};
 
-		return null;
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 
 	@Override
@@ -330,17 +353,23 @@ public List<URL> locateResources(String name) {
 
 	@Override
 	@SuppressWarnings("unchecked")
-	public <S> Collection<S> loadJavaServices(Class<S> serviceContract) {
-		ServiceLoader<S> serviceLoader = serviceLoaders.get( serviceContract );
-		if ( serviceLoader == null ) {
-			serviceLoader = ServiceLoader.load( serviceContract, getAggregatedClassLoader() );
-			serviceLoaders.put( serviceContract, serviceLoader );
-		}
-		final LinkedHashSet<S> services = new LinkedHashSet<S>();
-		for ( S service : serviceLoader ) {
-			services.add( service );
-		}
-		return services;
+	public <S> Collection<S> loadJavaServices(final Class<S> serviceContract) {
+		final PrivilegedAction<Collection<S>> action = new PrivilegedAction<Collection<S>>() {
+			@Override
+			public Collection<S> run() {
+				ServiceLoader<S> serviceLoader = serviceLoaders.get( serviceContract );
+				if ( serviceLoader == null ) {
+					serviceLoader = ServiceLoader.load( serviceContract, getAggregatedClassLoader() );
+					serviceLoaders.put( serviceContract, serviceLoader );
+				}
+				final LinkedHashSet<S> services = new LinkedHashSet<S>();
+				for ( S service : serviceLoader ) {
+					services.add( service );
+				}
+				return services;
+			}
+		};
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 
 	@Override
@@ -354,8 +383,14 @@ public <T> T generateProxy(InvocationHandler handler, Class... interfaces) {
 	}
 
 	@Override
-	public <T> T workWithClassLoader(Work<T> work) {
-		return work.doWork( getAggregatedClassLoader() );
+	public <T> T workWithClassLoader(final Work<T> work) {
+		final PrivilegedAction<T> action = new PrivilegedAction<T>() {
+			@Override
+			public T run() {
+				return work.doWork( getAggregatedClassLoader() );
+			}
+		};
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 
 	private ClassLoader getAggregatedClassLoader() {

hibernate-core/src/main/java/org/hibernate/cfg/annotations/HCANNHelper.java

@@ -28,6 +28,7 @@ public class HCANNHelper {
 		final Class<?> javaXMemberClass = JavaXMember.class;
 		try {
 			getMemberMethod = javaXMemberClass.getDeclaredMethod( "getMember" );
+			// NOTE : no need to check accessibility here - we know it is protected
 			getMemberMethod.setAccessible( true );
 		}
 		catch (NoSuchMethodException e) {

hibernate-core/src/main/java/org/hibernate/cfg/beanvalidation/BeanValidationIntegrator.java

@@ -52,7 +52,6 @@ public static void validateFactory(Object object) {
 			final Class activatorClass = BeanValidationIntegrator.class.getClassLoader().loadClass( ACTIVATOR_CLASS_NAME );
 			try {
 				final Method validateMethod = activatorClass.getMethod( VALIDATE_SUPPLIED_FACTORY_METHOD_NAME, Object.class );
-				validateMethod.setAccessible( true );
 				try {
 					validateMethod.invoke( null, object );
 				}

hibernate-core/src/main/java/org/hibernate/internal/util/ConfigHelper.java

@@ -10,6 +10,8 @@
 import java.io.InputStream;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 import org.hibernate.HibernateException;
 import org.hibernate.cfg.Environment;
@@ -112,29 +114,34 @@ public static InputStream getConfigStream(final String path) throws HibernateExc
 	private ConfigHelper() {
 	}
 
-	public static InputStream getResourceAsStream(String resource) {
-		String stripped = resource.startsWith( "/" )
-				? resource.substring( 1 )
-				: resource;
-
-		InputStream stream = null;
-		ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
-		if ( classLoader != null ) {
-			stream = classLoader.getResourceAsStream( stripped );
-		}
-		if ( stream == null ) {
-			stream = Environment.class.getResourceAsStream( resource );
-		}
-		if ( stream == null ) {
-			stream = Environment.class.getClassLoader().getResourceAsStream( stripped );
-		}
-		if ( stream == null ) {
-			throw new HibernateException( resource + " not found" );
-		}
-		return stream;
+	public static InputStream getResourceAsStream(final String resource) {
+		final PrivilegedAction<InputStream> action = new PrivilegedAction<InputStream>() {
+			@Override
+			public InputStream run() {
+				String stripped = resource.startsWith( "/" )
+						? resource.substring( 1 )
+						: resource;
+
+				InputStream stream = null;
+				ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+				if ( classLoader != null ) {
+					stream = classLoader.getResourceAsStream( stripped );
+				}
+				if ( stream == null ) {
+					stream = Environment.class.getResourceAsStream( resource );
+				}
+				if ( stream == null ) {
+					stream = Environment.class.getClassLoader().getResourceAsStream( stripped );
+				}
+				if ( stream == null ) {
+					throw new HibernateException( resource + " not found" );
+				}
+				return stream;
+			}
+		};
+		return System.getSecurityManager() != null ? AccessController.doPrivileged( action ) : action.run();
 	}
 
-
 	public static InputStream getUserResourceAsStream(String resource) {
 		boolean hasLeadingSlash = resource.startsWith( "/" );
 		String stripped = hasLeadingSlash ? resource.substring( 1 ) : resource;