mx4j/src/core/mx4j/remote/rmi RMIMarshaller.java,1.8,1.9

Update of /cvsroot/mx4j/mx4j/src/core/mx4j/remote/rmi
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv22642/src/core/mx4j/remote/rmi

Modified Files:
	RMIMarshaller.java 
Log Message:
Fixed security by running relevant code inside a privileged block

Index: RMIMarshaller.java
===================================================================
RCS file: /cvsroot/mx4j/mx4j/src/core/mx4j/remote/rmi/RMIMarshaller.java,v
retrieving revision 1.8
retrieving revision 1.9
diff -C2 -d -r1.8 -r1.9
*** RMIMarshaller.java	10 Mar 2004 18:33:35 -0000	1.8
--- RMIMarshaller.java	11 Mar 2004 10:54:05 -0000	1.9
***************
*** 21,30 ****
  import java.security.PrivilegedAction;
  import java.security.SecureClassLoader;
- import java.security.PrivilegedActionException;
- import java.security.PrivilegedExceptionAction;
  
  /**
   * Marshaller/Unmarshaller for RMI's MarshalledObjects. <br />
!  *
   * This class implements the JMX Remote Specification, chapter 2. <br />
   * <strong>
--- 21,28 ----
  import java.security.PrivilegedAction;
  import java.security.SecureClassLoader;
  
  /**
   * Marshaller/Unmarshaller for RMI's MarshalledObjects. <br />
!  * <p/>
   * This class implements the JMX Remote Specification, chapter 2. <br />
   * <strong>
***************
*** 68,107 ****
     private static Method getUnmarshalMethod()
     {
!       String marshallerName = Marshaller.class.getName();
!       InputStream stream = Marshaller.class.getResourceAsStream(marshallerName.substring(marshallerName.lastIndexOf('.') + 1) + ".class");
!       if (stream == null) throw new Error("Could not load implementation class " + marshallerName);
!       BufferedInputStream bis = new BufferedInputStream(stream);
!       ByteArrayOutputStream baos = new ByteArrayOutputStream();
!       BufferedOutputStream bos = new BufferedOutputStream(baos);
!       try
!       {
!          byte[] buffer = new byte[256];
!          int read = -1;
!          while ((read = bis.read(buffer)) >= 0) bos.write(buffer, 0, read);
!          bis.close();
!          bos.close();
!       }
!       catch (IOException x)
        {
!          throw new Error(x.toString());
!       }
  
!       byte[] classBytes = baos.toByteArray();
  
!       MarshallerClassLoader loader = new MarshallerClassLoader(classBytes);
  
!       try
!       {
!          Class cls = loader.loadClass(marshallerName);
!          return cls.getMethod("unmarshal", new Class[]{MarshalledObject.class});
!       }
!       catch (ClassNotFoundException x)
!       {
!          throw new Error(x.toString());
!       }
!       catch (NoSuchMethodException x)
!       {
!          throw new Error(x.toString());
!       }
     }
  
--- 66,111 ----
     private static Method getUnmarshalMethod()
     {
!       return (Method)AccessController.doPrivileged(new PrivilegedAction()
        {
!          public Object run()
!          {
!             String marshallerName = Marshaller.class.getName();
!             InputStream stream = Marshaller.class.getResourceAsStream(marshallerName.substring(marshallerName.lastIndexOf('.') + 1) + ".class");
!             if (stream == null) throw new Error("Could not load implementation class " + marshallerName);
!             BufferedInputStream bis = new BufferedInputStream(stream);
!             ByteArrayOutputStream baos = new ByteArrayOutputStream();
!             BufferedOutputStream bos = new BufferedOutputStream(baos);
!             try
!             {
!                byte[] buffer = new byte[256];
!                int read = -1;
!                while ((read = bis.read(buffer)) >= 0) bos.write(buffer, 0, read);
!                bis.close();
!                bos.close();
!             }
!             catch (IOException x)
!             {
!                throw new Error(x.toString());
!             }
  
!             byte[] classBytes = baos.toByteArray();
  
!             MarshallerClassLoader loader = new MarshallerClassLoader(classBytes);
  
!             try
!             {
!                Class cls = loader.loadClass(marshallerName);
!                return cls.getMethod("unmarshal", new Class[]{MarshalledObject.class});
!             }
!             catch (ClassNotFoundException x)
!             {
!                throw new Error(x.toString());
!             }
!             catch (NoSuchMethodException x)
!             {
!                throw new Error(x.toString());
!             }
!          }
!       });
     }
  
***************
*** 215,236 ****
           try
           {
!             return (Class)AccessController.doPrivileged(new PrivilegedExceptionAction()
!             {
!                public Object run() throws ClassNotFoundException
!                {
!                   try
!                   {
!                      return defineClass(name, bytes, 0, bytes.length, MarshallerClassLoader.this.getClass().getProtectionDomain());
!                   }
!                   catch (ClassFormatError x)
!                   {
!                      throw new ClassNotFoundException("Class Format Error", x);
!                   }
!                }
!             }, null);
           }
!          catch (PrivilegedActionException x)
           {
!             throw (ClassNotFoundException)x.getException();
           }
        }
--- 219,227 ----
           try
           {
!             return defineClass(name, bytes, 0, bytes.length, MarshallerClassLoader.this.getClass().getProtectionDomain());
           }
!          catch (ClassFormatError x)
           {
!             throw new ClassNotFoundException("Class Format Error", x);
           }
        }



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click