Skip to content

HHH-15514 EntityTestCase Test failures with Hibernate ORM when run under security manager #5328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

HHH-15514 EntityTestCase Test failures with Hibernate ORM when run under security manager #5328

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 43 additions & 49 deletions hibernate-core/src/main/java/org/hibernate/bytecode/internal/bytebuddy/ByteBuddyState.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ public final class ByteBuddyState {
private static final boolean DEBUG = false;

private final ByteBuddy byteBuddy;
private final ForDeclaredMethods getDeclaredMethodMemberSubstitution;
private final ForDeclaredMethods getMethodMemberSubstitution;

private static final ProxyDefinitionHelpers proxyDefinitionHelpers = new ProxyDefinitionHelpers();

Expand All @@ -84,9 +86,13 @@ public final class ByteBuddyState {
this.basicProxyCache = new TypeCache( TypeCache.Sort.WEAK );

if ( SystemSecurityManager.isSecurityManagerEnabled() ) {
this.classRewriter = new SecurityManagerClassRewriter();
this.getDeclaredMethodMemberSubstitution = getDeclaredMethodMemberSubstitution();
this.getMethodMemberSubstitution = getMethodMemberSubstitution();
this.classRewriter = null;
}
else {
this.getDeclaredMethodMemberSubstitution = null;
this.getMethodMemberSubstitution = null;
this.classRewriter = new StandardClassRewriter();
}
}
Expand Down Expand Up @@ -199,7 +205,13 @@ private Unloaded<?> make(DynamicType.Builder<?> builder) {
}

private Unloaded<?> make(TypePool typePool, DynamicType.Builder<?> builder) {
classRewriter.installReflectionMethodVisitors( builder );
if ( SystemSecurityManager.isSecurityManagerEnabled() ) {
builder = builder.visit( getDeclaredMethodMemberSubstitution );
builder = builder.visit( getMethodMemberSubstitution );
}
else {
classRewriter.installReflectionMethodVisitors( builder );
}

Unloaded<?> unloadedClass;
if ( typePool != null ) {
Expand All @@ -217,12 +229,39 @@ private Unloaded<?> make(TypePool typePool, DynamicType.Builder<?> builder) {
LOG.warn( "Unable to save generated class %1$s", unloadedClass.getTypeDescription().getName(), e );
}
}

classRewriter.registerAuthorizedClass( unloadedClass );
if ( SystemSecurityManager.isSecurityManagerEnabled() ) {
// we authorize the proxy class to access the method lookup dispatcher
HibernateMethodLookupDispatcher.registerAuthorizedClass( unloadedClass.getTypeDescription().getName() );
}
else {
classRewriter.registerAuthorizedClass( unloadedClass );
}

return unloadedClass;
}

private static ForDeclaredMethods getDeclaredMethodMemberSubstitution() {
// this should only be called if the security manager is enabled, thus the privileged calls
return MemberSubstitution.relaxed()
.method( ElementMatchers.is( AccessController.doPrivileged( new GetDeclaredMethodAction( Class.class,
"getDeclaredMethod", String.class, Class[].class ) ) ) )
.replaceWith(
AccessController.doPrivileged( new GetDeclaredMethodAction( HibernateMethodLookupDispatcher.class,
"getDeclaredMethod", Class.class, String.class, Class[].class ) ) )
.on( ElementMatchers.isTypeInitializer() );
}

private static ForDeclaredMethods getMethodMemberSubstitution() {
// this should only be called if the security manager is enabled, thus the privileged calls
return MemberSubstitution.relaxed()
.method( ElementMatchers.is( AccessController.doPrivileged( new GetDeclaredMethodAction( Class.class,
"getMethod", String.class, Class[].class ) ) ) )
.replaceWith(
AccessController.doPrivileged( new GetDeclaredMethodAction( HibernateMethodLookupDispatcher.class,
"getMethod", Class.class, String.class, Class[].class ) ) )
.on( ElementMatchers.isTypeInitializer() );
}

private static class GetDeclaredMethodAction implements PrivilegedAction<Method> {
private final Class<?> clazz;
private final String methodName;
Expand Down Expand Up @@ -323,51 +362,6 @@ private interface ClassRewriter {
void registerAuthorizedClass(Unloaded<?> unloadedClass);
}

private static class SecurityManagerClassRewriter implements ClassRewriter {

private final ForDeclaredMethods getDeclaredMethodMemberSubstitution;
private final ForDeclaredMethods getMethodMemberSubstitution;

private SecurityManagerClassRewriter() {
this.getDeclaredMethodMemberSubstitution = getDeclaredMethodMemberSubstitution();
this.getMethodMemberSubstitution = getMethodMemberSubstitution();
}

@Override
public void installReflectionMethodVisitors(DynamicType.Builder<?> builder) {
builder = builder.visit( getDeclaredMethodMemberSubstitution );
builder = builder.visit( getMethodMemberSubstitution );
}

@Override
public void registerAuthorizedClass(Unloaded<?> unloadedClass) {
// we authorize the proxy class to access the method lookup dispatcher
HibernateMethodLookupDispatcher.registerAuthorizedClass( unloadedClass.getTypeDescription().getName() );
}

private static ForDeclaredMethods getDeclaredMethodMemberSubstitution() {
// this should only be called if the security manager is enabled, thus the privileged calls
return MemberSubstitution.relaxed()
.method( ElementMatchers.is( AccessController.doPrivileged( new GetDeclaredMethodAction( Class.class,
"getDeclaredMethod", String.class, Class[].class ) ) ) )
.replaceWith(
AccessController.doPrivileged( new GetDeclaredMethodAction( HibernateMethodLookupDispatcher.class,
"getDeclaredMethod", Class.class, String.class, Class[].class ) ) )
.on( ElementMatchers.isTypeInitializer() );
}

private static ForDeclaredMethods getMethodMemberSubstitution() {
// this should only be called if the security manager is enabled, thus the privileged calls
return MemberSubstitution.relaxed()
.method( ElementMatchers.is( AccessController.doPrivileged( new GetDeclaredMethodAction( Class.class,
"getMethod", String.class, Class[].class ) ) ) )
.replaceWith(
AccessController.doPrivileged( new GetDeclaredMethodAction( HibernateMethodLookupDispatcher.class,
"getMethod", Class.class, String.class, Class[].class ) ) )
.on( ElementMatchers.isTypeInitializer() );
}
}

private static class StandardClassRewriter implements ClassRewriter {

@Override
Expand Down