RFC: security policy

Hello,

I'm a BeanShell newb, so please comment to help me climb the learning curve.

In unsigned JWS apps System.getProperty("user.home"); is not allowed. Also in 
the bsh code I see Boolean.getBoolean("debug") which is not allowed. In fact, 
I think for quick reference I'll post the small policy file that shows what 
exactly is allowed. <bottom>

Now, we can catch SecurityException but then unsigned environments are left 
out because I don't see any alternate mechanism in place.

My proposal: Accept an initial Properties Object to initialize BSH. Any 
initial properties. A specialized BSHProperties class would be created to 
first query the initial properties, and if the key wasn't found then the 
system property. This way we retain compatibility with the existing method of 
system properties, but give unsigned JWS developers an alternative mechanism 
to configuring BSH.

Thoughts?


File: tests/jws/bsh.policy (maybe jws.policy is a better name)
grant {
        permission java.net.SocketPermission "localhost:1024-", "listen";
        permission java.net.SocketPermission "localhost", "connect";
        permission java.net.SocketPermission "localhost", "accept";
        permission java.util.PropertyPermission "java.version", "read";
        permission java.util.PropertyPermission "java.vendor", "read";
        permission java.util.PropertyPermission "java.vendor.url", "read";
        permission java.util.PropertyPermission "java.class.version", "read";
        permission java.util.PropertyPermission "os.name", "read";
        permission java.util.PropertyPermission "os.version", "read";
        permission java.util.PropertyPermission "os.arch", "read";
        permission java.util.PropertyPermission "file.separator", "read";
        permission java.util.PropertyPermission "path.separator", "read";
        permission java.util.PropertyPermission "line.separator", "read";
        permission java.util.PropertyPermission "java.specification.version", 
"read";
        permission java.util.PropertyPermission "java.specification.vendor", 
"read";
        permission java.util.PropertyPermission "java.specification.name", 
"read";
        permission java.util.PropertyPermission 
"java.vm.specification.vendor", "read";
        permission java.util.PropertyPermission "java.vm.specification.name", 
"read";
        permission java.util.PropertyPermission "java.vm.version", "read";
        permission java.util.PropertyPermission "java.vm.vendor", "read";
        permission java.util.PropertyPermission "java.vm.name", "read";
        permission java.lang.RuntimePermission "exitVM";
        permission java.lang.RuntimePermission "stopThread";
        permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
        permission java.awt.AWTPermission "accessEventQueue";
};

-- 
VoIP SIP:[email protected]
Free calendar client and server - works with Exchange/Outlook/Yahoo!
TV-Listing and Weather Schedules
http://www.ScheduleWorld.com/
http://www.ScheduleWorld.com/sw/ScheduleWorld.jnlp (JWS)


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click