Name: skT45625 Date: 10/13/2000


java version "1.3.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.0-C)
Java HotSpot(TM) Client VM (build 1.3.0-C, mixed mode)


Running idlg for an interface X produces a _Xstub.java with the following
GENERATED code:

  private void readObject (java.io.ObjectInputStream s)
  {
     try
     {
       String str = s.readUTF ();
       org.omg.CORBA.Object obj
         = org.omg.CORBA.ORB.init ().string_to_object (str);
       org.omg.CORBA.portable.Delegate delegate =
         ((org.omg.CORBA.portable.ObjectImpl) obj)._get_delegate ();
       _set_delegate (delegate);
     } catch (java.io.IOException e) {}
  }

  private void writeObject (java.io.ObjectOutputStream s)
  {
     try
     {
       String str = org.omg.CORBA.ORB.init ().object_to_string (this);
       s.writeUTF (str);
     } catch (java.io.IOException e) {}
  }


Calling ORB.init() gets you, by default, an instance of
com.sun.corba.se.internal.corba.ORBSingleton.java. The code from that
class's object_to_string and string_to_object methods is:

    public String object_to_string(org.omg.CORBA.Object obj) {
throw new SecurityException("ORBSingleton: access denied");
    }

    public org.omg.CORBA.Object string_to_object(String s) {
throw new SecurityException("ORBSingleton: access denied");
    }

The generated code is wrong. It should call one of the other ORB.init methods
to it does not get the ORBSingleton class. The generated code also catches an
exception and ignores it. This is incredibly bad code! Finally, it is very
misleading for ORBSingleton to throw a SecurityException. I was trying to solve
the problem by looking at security management, policies, etc. It is not a
security issue at all. An UnsupportedOperationException would be much more
appropriate.
(Review ID: 110825)
======================================================================