search

jakartaee / jsonp-api

Jakarta JSON Processing
https://eclipse.org/ee4j/jsonp
Other
138 stars 59 forks source link

Missing doPrivileged when reading jakarta.json.provider system property #378

Closed KyleAure closed 2 years ago

KyleAure commented 2 years ago

Describe the bug JsonProvider.provider() fails with the following exception when using any JSON-P provider implementation and Java 2 security is enabled:

("java.util.PropertyPermission" "jakarta.json.provider" "read")
Stack: 
java.security.AccessControlException: Access denied ("java.util.PropertyPermission" "jakarta.json.provider" "read")java.base/java.security.AccessController.throwACE(AccessController.java:176)
java.base/java.security.AccessController.checkPermissionHelper(AccessController.java:238)
java.base/java.security.AccessController.checkPermission(AccessController.java:385)
java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:322)
com.ibm.ws.kernel.launch.internal.MissingDoPrivDetectionSecurityManager.checkPermission(MissingDoPrivDetectionSecurityManager.java:45)
java.base/java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1066)
java.base/java.lang.System.getProperty(System.java:506)
java.base/java.lang.System.getProperty(System.java:475)
jakarta.json.spi.JsonProvider$LazyFactoryLoader.<clinit>(JsonProvider.java:641)
jakarta.json.spi.JsonProvider.provider(JsonProvider.java:103)
at ...

Missing doPrivileged is at this line:

https://github.com/eclipse-ee4j/jsonp/blob/731d15b0df5ab958cd49f53dfea1319fdce673a0/api/src/main/java/jakarta/json/spi/JsonProvider.java#L641

To Reproduce Run with Java 2 security enabled

Expected behavior JsonProvider.provider() should succeed

System information:

OS: all
Java Version: 11
JSON-P Version: 2.1.0