RE: Security risks with HESSIAN/BURLAP serializers

Hi,
 
MX4J has been coded to work with a security manager installed, especially the JMX and JSR 160 mandatory implementations.
 
In this case, from the stack trace it's clear this is a problem in the hessian library.
You may find more help on hessian-interest mailing list.
 
Regards,
 
Simon


________________________________

	From: [email protected] [mailto:[email protected]] On Behalf Of Yoke Lee
	Sent: giovedì 10 febbraio 2005 20:57
	To: [email protected]
	Subject: [Mx4j-devel] Security risks with HESSIAN/BURLAP serializers
	
	

	Evidently, since HESSIAN/BURLAP protocols uses its own serializers that internally leverage the java.lang.reflect package to do its magic. This opens up a security risk for any servers by having to open up the Security Manager server policy to allow the java.lang.reflect to have read/write permissions. That is, the following line needs to be added to the server.policy file.

	 

	        permission java.lang.reflect "*", "*";

	 

	Any suggestions / ideas on this issue.

	 

	-------------------------------------------------------

	 

	java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks)
	 at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
	 at java.security.AccessController.checkPermission(AccessController.java:401)
	 at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
	 at java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:107)
	 at com.caucho.hessian.io.JavaSerializer.<init>(JavaSerializer.java:82)
	 at com.caucho.hessian.io.SerializerFactory.getDefaultSerializer(SerializerFactory.java:139)
	 at mx4j.tools.remote.caucho.serialization.JMXSerializerFactory.getDefaultSerializer(JMXSerializerFactory.java:22)
	 at com.caucho.hessian.io.SerializerFactory.getSerializer(SerializerFactory.java:115)
	 at com.caucho.hessian.io.HessianOutput.writeObject(HessianOutput.java:268)
	 at com.caucho.hessian.io.BasicSerializer.writeObject(BasicSerializer.java:238)
	 at com.caucho.hessian.io.HessianOutput.writeObject(HessianOutput.java:270)
	 at mx4j.tools.remote.caucho.hessian.HessianCauchoOutput.writeObject(HessianCauchoOutput.java:82)
	 at mx4j.tools.remote.caucho.CauchoClientInvoker$CauchoServiceProxy.writeArguments(CauchoClientInvoker.java:120)

	 

	 

	---------------

	 

	yoke