Security Manager Fixes #8
Conversation
…or container resolution of RESTEasy JAX-RS API impl" This reverts commit dc89191.
…ix to ignore the privileged action if the security manager is not present. https://issues.redhat.com/browse/JBEE-253
| errorMessage = "ClassCastException: attempting to cast" | ||
| + delegate.getClass().getClassLoader().getResource(classnameAsResource) | ||
| + " to " + targetTypeURL; |
There was a problem hiding this comment.
These lines and lines 92-94 are duplicates. Can't this be consolidated into a single point of definition?
There was a problem hiding this comment.
I thought about it. Really it's just the delegate.getClass().getClassLoader() that needs to be privileged, but there didn't seem to be a good way to break that up without two privileged blocks so I did it like this.
|
These 3 classes have a lot of common code. Can the common code be refactored into a utiltiy class that all can use? jaxrs-api/src/main/java/javax/ws/rs/ext/FactoryFinder.java |
|
I don't think there is since it uses privileged actions. If there was a single class then anyone could use it to load class with the permissions required. It could lead to security issues. |
The first commit reverts jboss/jboss-jaxrs-api_spec@b578e70, see https://issues.redhat.com/browse/JBEE-185
The second commit adds some new privileged actions https://issues.redhat.com/browse/JBEE-253.