RE: BeanShell working in unsigned JWS env.
"Shankar Unni" <[email protected]>
| Newsgroups | gmane.comp.java.beanshell.devel |
|---|---|
| Message-ID | <[email protected]> |
Mark Swanson wrote: > I'm happy to announce BeanShell now works in an unsigned JWS env! Yay. But hold your horses.. > In a way, you don't have to trust BeanShell because > you don't have to - it can only call public methods. That's wonderful, but your posted diffs enforce this unconditionally, rather than only in a "secure" environment. BeanShell is used for a lot more than "publicly safe scripting interfaces", so such a change is inappropriate. BeanShell already has an interface called "setVisible(true)" which is supposed to enforce such visibility rules, and any change should be done in conjunction with that - if setVisible(false) has been called, *then* call only getMethods() etc., instead of getDeclaredMethods(). Then, in your JWS environment, you can call "setVisible(false)" and get secure reflective access. Also, the XThis constructor change (package protected to public) is interesting: why did you do this? (I could use this change, too!). ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click