search

eclipse-birt / birt

Eclipse BIRT™ The open source reporting and data visualization project.
http://www.eclipse.org/birt
Eclipse Public License 2.0
424 stars 386 forks source link

securityDomain should be null if setSecurityController() was never called #1778

Closed len-ro closed 1 day ago

len-ro commented 3 days ago

No report can be run when deploying birt 4.16 in a tomcat with securityManager on. I am trying to upgrade birt from an older 3 version and have tried with various combinations of java and birt 4 version yet I am having this error:

java.lang.IllegalArgumentException: securityDomain should be null if setSecurityController() was never called
   at org.mozilla.javascript.Context.compileImpl(Context.java:2422)
   at org.mozilla.javascript.Context.compileString(Context.java:1404)
   at org.mozilla.javascript.Context.compileString(Context.java:1392)
   at org.eclipse.birt.report.engine.javascript.JavascriptEngine.compile(JavascriptEngine.java:214)
   at org.eclipse.birt.report.engine.javascript.JavascriptEngine.compile(JavascriptEngine.java:1)
   at org.eclipse.birt.core.script.ScriptContext.compile(ScriptContext.java:127)
   at org.eclipse.birt.report.engine.executor.ExecutionContext.compile(ExecutionContext.java:694)
   at org.eclipse.birt.report.engine.executor.ExecutionContext.evaluate(ExecutionContext.java:686)
   at org.eclipse.birt.report.engine.executor.ExecutionContext.evaluate(ExecutionContext.java:671)
   at org.eclipse.birt.report.engine.api.impl.EngineTask.validateAbstractScalarParameter(EngineTask.java:701)
   at

Seems related (or the same) as: https://bugs.eclipse.org/bugs/show_bug.cgi?id=412170. Yes I know the securityManager is deprecated and will be removed but I cannot drop it at this point. Anyone had a similar issue?

Thanks.

len-ro commented 3 days ago

Just to respond to my own comment, patching birt as in: https://github.com/len-ro/rhino-fork-for-birt/tree/Rhino1_7_15_Release_branch solves this issue for birt 4.16 which is using js.jar 1.7.15. Maybe there is a more elegant solution to do this?

speckyspooky commented 2 days ago

I have reserached the location of the security manager on the BIRT project.

But I cannot change something to handle an issue based from another project when I have to use deprecated classes to make functionality available and later to remove it again. We go ahead step by step to support higher JDK version so the next version will be LTS JDK 21 and so it is more important to remove the deprecated stuff.

May be your fix solved your problem. I started a draft-PR to remove the security manager. But this will not solve your problem.

len-ro commented 1 day ago

Thank you for the response. You are right, the issue is in the rhino library which expects an additional config if a securityManager is set at jvm level (maybe in the way rhino is called from birt?). My rhino fork fixes the issue so I did not investigated further.