BeanShell working in unsigned JWS env.

Hello,

I'm happy to announce BeanShell now works in an unsigned JWS env!
(There is still the Sytem property problem to solve, but no one has commented 
on my proposed fix yet. Nudge...)

The supplied patches are all that is necessary. There is a major ramification 
to this: BeanShell can no longer be used to violate protected and private 
classes, members, or attributes. For many reasons I feel this is a very good 
thing. Even people running with no SecurityManager should not be messing with 
private constructors/methods/attributes, and there should never be a need to.

As a side note, this is quite interesting. C++ developers have always been 
able to cast away 'const' correctness. Java developers are able to use 
Reflection. In the unsigned JWS environment there is finally a perfect place 
where you can 100% enforce your public contracts. You can't pull any 
classloader tricks, nor any reflection tricks to bypass the contract. In a 
way, you don't have to trust BeanShell because you don't have to - it can 
only call public methods.

If I was using a scripting language to build or augment a web[site,app] or an 
application I would want to use a scripting language that worked in an 
environment I could trust. Now bsh can.

I'm looking forward to some good arguments to allow BeanShell to continue to 
violate protected/private classes/members/attributes :-)

Cheers.

********** XThis.java patch:
(ctor MUST be public)

Index: XThis.java
===================================================================
RCS file: /cvsroot/beanshell/BeanShell/src/bsh/XThis.java,v
retrieving revision 1.23
diff -u -3 -p -r1.23 XThis.java
--- XThis.java  21 Apr 2004 04:17:37 -0000      1.23
+++ XThis.java  30 Apr 2004 22:06:01 -0000
@@ -67,7 +67,7 @@ class XThis extends This

        InvocationHandler invocationHandler = new Handler();

-       XThis( NameSpace namespace, Interpreter declaringInterp ) {
+       public XThis( NameSpace namespace, Interpreter declaringInterp ) {
                super( namespace, declaringInterp );
        }

********** Reflect.java patch:

Index: Reflect.java
===================================================================
RCS file: /cvsroot/beanshell/BeanShell/src/bsh/Reflect.java,v
retrieving revision 1.51
diff -u -3 -p -r1.51 Reflect.java
--- Reflect.java        21 Apr 2004 04:17:37 -0000      1.51
+++ Reflect.java        30 Apr 2004 22:09:51 -0000
@@ -366,7 +366,8 @@ class Reflect
                while ( clas != null )
                {
                        try {
-                               field = clas.getDeclaredField(fieldName);
+                               field = clas.getField(fieldName);
+                               //field = clas.getDeclaredField(fieldName);
                                ReflectManager.RMSetAccessible( field );
                                return field;

@@ -484,7 +485,8 @@ class Reflect
                        Class c = clas;
                        while( c != null )
                        {
-                               Method [] m = c.getDeclaredMethods();
+                               Method [] m = c.getMethods();
+                               //Method [] m = c.getDeclaredMethods();
                                for(int i=0; i<m.length; i++)
                                        mv.add( m[i] );
                                c = c.getSuperclass();
@@ -572,7 +574,8 @@ class Reflect
                        {
                                try
                                {
-                                       meth = c.getDeclaredMethod( name, 
types );
+                                       meth = c.getMethod( name, types );
+                                       //meth = c.getDeclaredMethod( name, 
types );

                                        // Is the method public or are we in 
accessibility mode?
                                        if 
( ( Modifier.isPublic( meth.getModifiers() )
@@ -640,7 +643,9 @@ class Reflect
                        use declared here to see package and private as well
                        (there are no inherited constructors to worry about)
                */
-               Constructor[] constructors = clas.getDeclaredConstructors();
+               // MS: accessing private is a bug
+               Constructor[] constructors = clas.getConstructors();
+               //Constructor[] constructors = clas.getDeclaredConstructors();
                if ( Interpreter.DEBUG )
                        Interpreter.debug("Looking for most specific 
constructor: "+clas);
                con = findMostSpecificConstructor(types, constructors);


********* New JWSTest.java
(The Swing deadlocks were because of my test code. I knew the original code 
was wrong but (like all of Sun's examples prior to 2004) never saw it break 
before. Neat.)

//
// $Id:$
//

import bsh.Interpreter;
import java.io.*;
import java.util.*;
import javax.swing.*;

/**
 *
 */
public class JWSTest {

    public static void main (String args[]) throws Exception {
        JWSTest jwsTest = new JWSTest();
        jwsTest.test();
    }

    void test() throws Exception {
        InputStream is = 
this.getClass().getClassLoader().getResourceAsStream("bsh/commands/printBanner.bsh");
        if (is == null) {
            System.out.println("rats");
            System.exit(-1);
        }

        /*Interpreter i = new Interpreter();  // Construct an interpreter
        i.set("foo", 5);                    // Set variables
        i.set("date", new Date() );

        Date date = (Date)i.get("date");    // retrieve a variable
        System.out.println("date:" + date);

        // Eval a statement and get the result
        i.eval("bar = foo*10");
        System.out.println( i.get("bar") );

        // Source an external script file
        //i.source("test.bsh");
        */

        final JFrame frame = new JFrame("Bean Shell");
        bsh.util.JConsole jConsole = new bsh.util.JConsole();
        jConsole.setSize(600, 400);
        bsh.Interpreter interpreter = new bsh.Interpreter(jConsole);
        new Thread(interpreter).start();
        frame.getContentPane().add("Center", jConsole);
        frame.setLocation(600, 400);
        //frame.pack();
        SwingUtilities.invokeLater(new Runnable() {
            public void run() {
                frame.setVisible(true);
            }
        });
    }

}

Cheers.


-- 
VoIP SIP:[email protected]
Free calendar client and server - works with Exchange/Outlook/Yahoo!
TV-Listing and Weather Schedules
http://www.ScheduleWorld.com/
http://www.ScheduleWorld.com/sw/ScheduleWorld.jnlp (JWS)


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click