Name: krT82822 Date: 08/10/99


In package org.omg.CORBA.ORB, line 199-201, the user's ORB class is looked up using the system classloader. It should be looked up using the context classloader. As a matter of fact, there is a line that is commented out that does the right thing.

It is commented out with the following comment

// For JDK1.2
// Dont use the ContextClassLoader because it would potentially
// allow an untrusted applet to install the shared singleton ORB.
// ClassLoader cl = Thread.currentThread().getContextClassLoader();

This is simply not correct. There is a security check on set/getContextClassLoader that would prevent this from happening.

This is a HUGE impediment for us, since we have a app server that makes extensive use of dynamic classloading, and this prevents us from loading an ORB in the proper fashion.
(Review ID: 93546)
======================================================================