Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-4162678

remove doPrivilege blocks from Beans access to .gif and .ser

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Cannot Reproduce
    • Icon: P4 P4
    • 9
    • 9
    • client-libs
    • None
    • x86
    • windows_nt

      As parts of trying to fix 4141523 and 4137727, some doPrivileged blocks were
      added to java.beans.* to allow access to resources which would otherwise be
      inaccessible.

      These were in:
      Beans.instantiate when accessing .ser files
      SimpleBeanInfo.loadImage when accessing .gif files

      After discussions in the beans team, we have considerable concern that these
      two doPrivileged blocks introduce special cases that are undesirable and
      are likely to confuses users. For example, why can I get at a foo.gif
      if I go through SimpleBeanInfo.loadImage but not if I try to access the
      resource directly? Similarly, why can I get at foo.gif but not at foo.au
      in the same directory?

      Roland Schemers has solved the more general resource problem by allowing
      untrusted code to read resources from its .jar or its classpath. This
      provide a consistent set of rules for resource access that fix the
      original bugs.

      We'd therefore like to back out the two doPrivileged blocks.

      Note: since beans is frozen for 1.2, this will require review by the release team.

      graham.hamilton@Eng 1998-08-01

            serb Sergey Bylokhov
            ghamiltosunw Graham Hamilton (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: