r9818 - helma-ng/trunk/src/org/helma/javascript

Author: hannes
Date: 2009-06-02 20:29:07 +0200 (Tue, 02 Jun 2009)
New Revision: 9818

Modified:
   helma-ng/trunk/src/org/helma/javascript/RhinoEngine.java
Log:
Update comment and remove FIXME in findResource().

Details at http://dev.helma.org/trac/helma/changeset/9818

Modified: helma-ng/trunk/src/org/helma/javascript/RhinoEngine.java
===================================================================
--- helma-ng/trunk/src/org/helma/javascript/RhinoEngine.java	2009-05-29 15:06:14 UTC (rev 9817)
+++ helma-ng/trunk/src/org/helma/javascript/RhinoEngine.java	2009-06-02 18:29:07 UTC (rev 9818)
@@ -530,10 +530,8 @@
      * @return the resource
      */
     public Resource findResource(String path, Repository localRoot) {
-        // FIXME: we allow absolute module paths, and we do not check
-        // if relative paths escape their root repository. These are
-        // of course gaping security holes for environments running
-        // non-trusted code.
+        // Note: as an extension to the securable modules API
+        // we allow absolute module paths for resources
         File file = new File(path);
         if (file.isAbsolute()) {
             return new FileResource(file);