-
Bug
-
Resolution: Cannot Reproduce
-
P4
-
9
-
None
-
x86
-
windows_nt
As parts of trying to fix 4141523 and 4137727, some doPrivileged blocks were
added to java.beans.* to allow access to resources which would otherwise be
inaccessible.
These were in:
Beans.instantiate when accessing .ser files
SimpleBeanInfo.loadImage when accessing .gif files
After discussions in the beans team, we have considerable concern that these
two doPrivileged blocks introduce special cases that are undesirable and
are likely to confuses users. For example, why can I get at a foo.gif
if I go through SimpleBeanInfo.loadImage but not if I try to access the
resource directly? Similarly, why can I get at foo.gif but not at foo.au
in the same directory?
Roland Schemers has solved the more general resource problem by allowing
untrusted code to read resources from its .jar or its classpath. This
provide a consistent set of rules for resource access that fix the
original bugs.
We'd therefore like to back out the two doPrivileged blocks.
Note: since beans is frozen for 1.2, this will require review by the release team.
graham.hamilton@Eng 1998-08-01
added to java.beans.* to allow access to resources which would otherwise be
inaccessible.
These were in:
Beans.instantiate when accessing .ser files
SimpleBeanInfo.loadImage when accessing .gif files
After discussions in the beans team, we have considerable concern that these
two doPrivileged blocks introduce special cases that are undesirable and
are likely to confuses users. For example, why can I get at a foo.gif
if I go through SimpleBeanInfo.loadImage but not if I try to access the
resource directly? Similarly, why can I get at foo.gif but not at foo.au
in the same directory?
Roland Schemers has solved the more general resource problem by allowing
untrusted code to read resources from its .jar or its classpath. This
provide a consistent set of rules for resource access that fix the
original bugs.
We'd therefore like to back out the two doPrivileged blocks.
Note: since beans is frozen for 1.2, this will require review by the release team.
graham.hamilton@Eng 1998-08-01