Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-4950756

RequiredModelMBean must only invoke its own methods if they're in ModelMBeanInfo

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: P3
    • Resolution: Fixed
    • Affects Version/s: 1.2.1
    • Fix Version/s: 5.0
    • Component/s: core-svc
    • Labels:
    • Subcomponent:
    • Resolved In Build:
      b32
    • CPU:
      generic
    • OS:
      generic

      Description

      As of JMX 1.2, the spec makes explicit the behaviour that was formerly only implied indirectly, whereby if you invoke a method through the MBean Server on a RequiredModelMBean, and that method corresponds to a public method of the RequiredModelMBean class itself, then that is the method that should be called, rather than a method on the Managed Resource as would usually be the case. However, the Reference Implementation does this even if the method in question is not declared in the ModelMBeanInfo. That is very surprising behaviour, and potentially a security problem. Only methods in ModelMBeanInfo should be invoked.

        Attachments

          Activity

            People

            Assignee:
            emcmanus Eamonn McManus
            Reporter:
            emcmanus Eamonn McManus
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: