Security risks with HESSIAN/BURLAP serializers

Evidently, since HESSIAN/BURLAP protocols uses its own serializers that
internally leverage the java.lang.reflect package to do its magic. This
opens up a security risk for any servers by having to open up the
Security Manager server policy to allow the java.lang.reflect to have
read/write permissions. That is, the following line needs to be added to
the server.policy file.

 

        permission java.lang.reflect "*", "*";

 

Any suggestions / ideas on this issue.

 

-------------------------------------------------------

 

java.security.AccessControlException: access denied
(java.lang.reflect.ReflectPermission suppressAccessChecks)
 at
java.security.AccessControlContext.checkPermission(AccessControlContext.
java:269)
 at
java.security.AccessController.checkPermission(AccessController.java:401
)
 at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
 at
java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:1
07)
 at com.caucho.hessian.io.JavaSerializer.<init>(JavaSerializer.java:82)
 at
com.caucho.hessian.io.SerializerFactory.getDefaultSerializer(SerializerF
actory.java:139)
 at
mx4j.tools.remote.caucho.serialization.JMXSerializerFactory.getDefaultSe
rializer(JMXSerializerFactory.java:22)
 at
com.caucho.hessian.io.SerializerFactory.getSerializer(SerializerFactory.
java:115)
 at
com.caucho.hessian.io.HessianOutput.writeObject(HessianOutput.java:268)
 at
com.caucho.hessian.io.BasicSerializer.writeObject(BasicSerializer.java:2
38)
 at
com.caucho.hessian.io.HessianOutput.writeObject(HessianOutput.java:270)
 at
mx4j.tools.remote.caucho.hessian.HessianCauchoOutput.writeObject(Hessian
CauchoOutput.java:82)
 at
mx4j.tools.remote.caucho.CauchoClientInvoker$CauchoServiceProxy.writeArg
uments(CauchoClientInvoker.java:120)

 

 

---------------

 

yoke