mx4j/src/core/mx4j/remote/rmi RMIConnectionInvoker.java,1.9,1.10

Update of /cvsroot/mx4j/mx4j/src/core/mx4j/remote/rmi
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv687/core/mx4j/remote/rmi

Modified Files:
	RMIConnectionInvoker.java 
Log Message:
Fixed security for this class: when marshalling/unmarshalling arguments, a call to getClassLoader*() is needed, and must be wrapped into privileged blocks

Index: RMIConnectionInvoker.java
===================================================================
RCS file: /cvsroot/mx4j/mx4j/src/core/mx4j/remote/rmi/RMIConnectionInvoker.java,v
retrieving revision 1.9
retrieving revision 1.10
diff -C2 -d -r1.9 -r1.10
*** RMIConnectionInvoker.java	24 Feb 2004 14:09:58 -0000	1.9
--- RMIConnectionInvoker.java	1 Mar 2004 18:17:44 -0000	1.10
***************
*** 12,15 ****
--- 12,19 ----
  import java.rmi.MarshalledObject;
  import java.security.SecureClassLoader;
+ import java.security.AccessController;
+ import java.security.PrivilegedExceptionAction;
+ import java.security.PrivilegedAction;
+ import java.security.PrivilegedActionException;
  import java.util.ArrayList;
  import java.util.Map;
***************
*** 102,110 ****
             IOException
     {
!       Object[] args = (Object[])RMIMarshaller.unmarshal(params, new RepositoryClassLoader(server.getClassLoaderRepository()), defaultLoader);
        return server.createMBean(className, name, args, signature);
     }
  
!    public ObjectInstance createMBean(String className, ObjectName name, ObjectName loaderName, MarshalledObject params, String[] signature, Subject delegate)
             throws ReflectionException,
             InstanceAlreadyExistsException,
--- 106,121 ----
             IOException
     {
!       RepositoryClassLoader loader = (RepositoryClassLoader)AccessController.doPrivileged(new PrivilegedAction()
!       {
!          public Object run()
!          {
!             return new RepositoryClassLoader(server.getClassLoaderRepository());
!          }
!       });
!       Object[] args = (Object[])RMIMarshaller.unmarshal(params, loader, defaultLoader);
        return server.createMBean(className, name, args, signature);
     }
  
!    public ObjectInstance createMBean(String className, ObjectName name, final ObjectName loaderName, MarshalledObject params, String[] signature, Subject delegate)
             throws ReflectionException,
             InstanceAlreadyExistsException,
***************
*** 115,120 ****
             IOException
     {
!       Object[] args = (Object[])RMIMarshaller.unmarshal(params, server.getClassLoader(loaderName), defaultLoader);
!       return server.createMBean(className, name, loaderName, args, signature);
     }
  
--- 126,145 ----
             IOException
     {
!       try
!       {
!          ClassLoader loader = (ClassLoader)AccessController.doPrivileged(new PrivilegedExceptionAction()
!          {
!             public Object run() throws InstanceNotFoundException
!             {
!                return server.getClassLoader(loaderName);
!             }
!          });
!          Object[] args = (Object[])RMIMarshaller.unmarshal(params, loader, defaultLoader);
!          return server.createMBean(className, name, loaderName, args, signature);
!       }
!       catch (PrivilegedActionException x)
!       {
!          throw (InstanceNotFoundException)x.getException();
!       }
     }
  
***************
*** 175,179 ****
             IOException
     {
!       Attribute attrib = (Attribute)RMIMarshaller.unmarshal(attribute, server.getClassLoaderFor(name), defaultLoader);
        server.setAttribute(name, attrib);
     }
--- 200,204 ----
             IOException
     {
!       Attribute attrib = (Attribute)RMIMarshaller.unmarshal(attribute, getClassLoaderFor(name), defaultLoader);
        server.setAttribute(name, attrib);
     }
***************
*** 184,188 ****
             IOException
     {
!       AttributeList attribs = (AttributeList)RMIMarshaller.unmarshal(attributes, server.getClassLoaderFor(name), defaultLoader);
        return server.setAttributes(name, attribs);
     }
--- 209,213 ----
             IOException
     {
!       AttributeList attribs = (AttributeList)RMIMarshaller.unmarshal(attributes, getClassLoaderFor(name), defaultLoader);
        return server.setAttributes(name, attribs);
     }
***************
*** 194,198 ****
             IOException
     {
!       Object[] args = (Object[])RMIMarshaller.unmarshal(params, server.getClassLoaderFor(name), defaultLoader);
        return server.invoke(name, operationName, args, signature);
     }
--- 219,223 ----
             IOException
     {
!       Object[] args = (Object[])RMIMarshaller.unmarshal(params, getClassLoaderFor(name), defaultLoader);
        return server.invoke(name, operationName, args, signature);
     }
***************
*** 221,226 ****
             throws InstanceNotFoundException, IOException
     {
!       NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, server.getClassLoaderFor(name), defaultLoader);
!       Object h = RMIMarshaller.unmarshal(handback, server.getClassLoaderFor(name), defaultLoader);
        server.addNotificationListener(name, listener, f, h);
     }
--- 246,252 ----
             throws InstanceNotFoundException, IOException
     {
!       ClassLoader loader = getClassLoaderFor(name);
!       NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, loader, defaultLoader);
!       Object h = RMIMarshaller.unmarshal(handback, loader, defaultLoader);
        server.addNotificationListener(name, listener, f, h);
     }
***************
*** 235,240 ****
             throws InstanceNotFoundException, ListenerNotFoundException, IOException
     {
!       NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, server.getClassLoaderFor(name), defaultLoader);
!       Object h = RMIMarshaller.unmarshal(handback, server.getClassLoaderFor(name), defaultLoader);
        server.removeNotificationListener(name, listener, f, h);
     }
--- 261,267 ----
             throws InstanceNotFoundException, ListenerNotFoundException, IOException
     {
!       ClassLoader loader = getClassLoaderFor(name);
!       NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, loader, defaultLoader);
!       Object h = RMIMarshaller.unmarshal(handback, loader, defaultLoader);
        server.removeNotificationListener(name, listener, f, h);
     }
***************
*** 247,251 ****
           ObjectName name = names[i];
           MarshalledObject filter = filters[i];
!          NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, server.getClassLoaderFor(name), defaultLoader);
           Integer id = notificationHandler.generateListenerID(name, f);
           NotificationListener listener = notificationHandler.getServerNotificationListener();
--- 274,278 ----
           ObjectName name = names[i];
           MarshalledObject filter = filters[i];
!          NotificationFilter f = (NotificationFilter)RMIMarshaller.unmarshal(filter, getClassLoaderFor(name), defaultLoader);
           Integer id = notificationHandler.generateListenerID(name, f);
           NotificationListener listener = notificationHandler.getServerNotificationListener();
***************
*** 292,295 ****
--- 319,347 ----
     }
  
+    private ClassLoader getClassLoaderFor(final ObjectName name) throws InstanceNotFoundException
+    {
+       if (System.getSecurityManager() == null)
+       {
+          return server.getClassLoaderFor(name);
+       }
+       else
+       {
+          try
+          {
+             return (ClassLoader)AccessController.doPrivileged(new PrivilegedExceptionAction()
+             {
+                public Object run() throws InstanceNotFoundException
+                {
+                   return server.getClassLoaderFor(name);
+                }
+             });
+          }
+          catch (PrivilegedActionException x)
+          {
+             throw (InstanceNotFoundException)x.getException();
+          }
+       }
+    }
+ 
     private static class RepositoryClassLoader extends SecureClassLoader
     {



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click