search

jakartaee / expression-language

Jakarta Expression Language
https://eclipse.org/ee4j/el
Other
69 stars 50 forks source link

Address permission checks when running under Security Manager #132

Closed volosied closed 3 years ago

volosied commented 4 years ago

Fixes #131

This was not as direct as it originally seemed because various AccessControl exceptions were encountered:

java.security.AccessControlException: Access denied (“java.util.PropertyPermission” “java.home” “read”)

java.security.AccessControlException: Access denied (“java.io.FilePermission” “/Library/Java/JavaVirtualMachines/adoptopenjdk-11-openj9.jdk/Contents/Home/lib/el.properties” “read”)

(“java.util.PropertyPermission” “jakarta.el.ExpressionFactory” “read”) java.security.AccessControlException: Access denied (“java.lang.RuntimePermission” “getClassLoader”)

java.security.AccessControlException: Access denied (“java.lang.RuntimePermission” “accessDeclaredMembers”)

I would appreciate any feedback. Thank you

markt-asf commented 3 years ago

@volosied I'm afraid Eclipse policy requires that you sign the ECA before we can accept this PR. Please see https://wiki.eclipse.org/Development_Resources/Contributing_via_Git

arjantijms commented 3 years ago

Note that for the next versions we should remove the security manager permission checks entirely, as the security manager will be removed from Java.

volosied commented 2 years ago

@markt-asf Any chance this fix can be applied to the 4.x branch? Should I make a new PR or can you apply it?

Thanks

Edit: Meant 4.0.