Re: RFC: security policy
Slava Pestov <[email protected]>
| Newsgroups | gmane.comp.java.beanshell.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Apr 29, 2004 at 10:21:50PM -0400, Mark Swanson wrote:
> In unsigned JWS apps System.getProperty("user.home"); is not allowed. Also in
> the bsh code I see Boolean.getBoolean("debug") which is not allowed. In fact,
> I think for quick reference I'll post the small policy file that shows what
> exactly is allowed.
I think the debug property can be eliminated; if a user wants it set,
they can just set the static field. As for user.home, loadRCFiles() is
protected with try/catch, so not being able to access this property
should not cause any problems, no?
--
Slava Pestov
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click