/
test.policy
127 lines (99 loc) · 5.13 KB
/
test.policy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
/**
* Policy file for running the Bean Validation TCK within a security manager.
*
* The goal if this is to make sure that all SM-relevant APIs are invoked by Hibernate Validator using privileged
* actions so it can be used within an SM enabled, only giving the required permissions to Hibernate Validator but not
* other code which uses it.
*
* For that purpose this test set up puts one frame onto the call stack (via {@code DelegatingExecutor}) whose
* protection domain (target/classes) has no permissions assigned at all. That way any missing privileged actions in
* Hibernate Validator would lead to an access control exception. All the other domains involved in tests (e.g.
* Arquillian or TestNG) are assigned with "all permissions" to keep this set-up manageable. As the privilege-less
* DelegatingExecutor frame is located in the stack very close to the actual code under test, it is ensured that
* any possible privileged blocks within these domains will not conceal any missing privileged blocks in Hibernate
* Validator (only one Arquillian class and the BV TCK domain are located in between and both don't use any privileged
* actions).
*/
/* =============================================== */
/* Hibernate Validator engine and its dependencies */
/* =============================================== */
// Used during builds which obtain "engine" from the local repo, e.g. mvn clean install -pl tck-runner
// replace with this when debugging in the IDE with workspace resolution
// grant codeBase "file:/<project-dir>/engine/target/classes/" {
grant codeBase "file:${localRepository}/org/hibernate/hibernate-validator/${project.version}/hibernate-validator-${project.version}.jar" {
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.RuntimePermission "setContextClassLoader";
permission org.hibernate.validator.HibernateValidatorPermission "accessPrivateMembers";
// JAXB
permission java.util.PropertyPermission "mapAnyUriToUri", "read";
};
// Used during aggregator builds also building "engine", e.g. mvn clean install -pl tck-runner -am
grant codeBase "file:${basedir}/../engine/target/hibernate-validator-${project.version}.jar" {
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.RuntimePermission "setContextClassLoader";
permission org.hibernate.validator.HibernateValidatorPermission "accessPrivateMembers";
// JAXB
permission java.util.PropertyPermission "mapAnyUriToUri", "read";
};
grant codeBase "file:${localRepository}/com/fasterxml/classmate/-" {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};
grant codeBase "file:${localRepository}/org/jboss/logging/jboss-logging/-" {
permission java.util.PropertyPermission "org.jboss.logging.provider", "read";
};
/* =================== */
/* Bean Validation API */
/* =================== */
grant codeBase "file:${localRepository}/javax/validation/validation-api/-" {
permission java.io.FilePermission "<<ALL FILES>>", "read";
// in some tests this property is accessed by the TCK when the API JAR is on the callstack; the TCK doesn't
// use privileged actions, hence allow this read
permission java.util.PropertyPermission "validation.provider", "read";
};
/* =================== */
/* Bean Validation TCK */
/* =================== */
grant codeBase "file:${localRepository}/org/hibernate/beanvalidation/tck/-" {
permission java.security.AllPermission;
};
/* ========== */
/* TCK Runner */
/* ========== */
// Ideally, this domain should have no permissions at all; Only specifically enabling some API calls done by the BV TCK
// tests (which do not use privileged actions for these)
grant codeBase "file:${project.build.directory}/classes" {
permission java.util.PropertyPermission "validation.provider", "read";
permission java.io.FilePermission "${localRepository}/org/hibernate/beanvalidation/tck/beanvalidation-tck-tests/${tck.version}/beanvalidation-tck-tests-${tck.version}.jar", "read";
permission java.util.PropertyPermission "user.language", "write";
permission org.hibernate.validator.HibernateValidatorPermission "accessPrivateMembers";
};
grant codeBase "file:${project.build.directory}/test-classes" {
permission java.security.AllPermission;
};
/* ===================== */
/* Arquillian/ShrinkWrap */
/* ===================== */
grant codeBase "file:${localRepository}/org/jboss/arquillian/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${localRepository}/org/jboss/shrinkwrap/-" {
permission java.security.AllPermission;
};
/* ======= */
/* TestNG */
/* ======= */
grant codeBase "file:${localRepository}/org/testng/testng/-" {
permission java.security.AllPermission;
};
// Dependency of TestNG
grant codeBase "file:${localRepository}/org/beanshell/-" {
permission java.security.AllPermission;
};
/* ========= */
/* Surefire */
/* ========= */
grant codeBase "file:${localRepository}/org/apache/maven/surefire/-" {
permission java.security.AllPermission;
};