Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6359330

(rb) REGRESSION: ResourceBundle creates ClassLoader without calling doPrivileged

    XMLWordPrintable

    Details

    • Subcomponent:
    • Introduced In Build:
      b38
    • Introduced In Version:
      6
    • Resolved In Build:
      b72
    • CPU:
      sparc
    • OS:
      solaris_9

      Description

      FULL PRODUCT VERSION :
      java version "1.6.0-rc"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.6.0-rc-b62)
      Java HotSpot(TM) Server VM (build 1.6.0-rc-b62, mixed mode)


      ADDITIONAL OS VERSION INFORMATION :
      SunOS ceti.umiacs.umd.edu 5.9 gspot:s9u2_beta:07/09/2003 sun4u sparc SUNW,Sun-Fire


      A DESCRIPTION OF THE PROBLEM :
      When ResourceBundle.getBundle is called from system code, it creates a
      java.util.ResourceBundle$RBClassLoader, but doesn't do it
      in a doPriviledged block.

      As a result, if Java is running with a security manager in place, and unpriviledged
      code calls a system class that invokes ResourceBundle.getBundle, a security exception
      results.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      For example, with a security manager in place, run a method that creates a SAXParser and sets a non-existent property. This will force the SAX code to load a bundle containing localized error messages.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      It throws org.xml.sax.SAXNotRecognizedException: Property 'foo' is not recognized.

      ACTUAL -
      It gets an AccessControlException (stack trace given in error msg field)

      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      > java -Djava.security.manager Foo
      java.lang.ExceptionInInitializerError
              at java.util.ResourceBundle.getLoader(ResourceBundle.java:411)
              at java.util.ResourceBundle.getBundle(ResourceBundle.java:771)
              at com.sun.org.apache.xerces.internal.util.SAXMessageFormatter.formatMessage(SAXMessageFormatter.java:53)
              at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.getProperty(AbstractSAXParser.java:2060)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.setProperty(SAXParserImpl.java:467)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl.setProperty(SAXParserImpl.java:263)
              at Foo.main(Foo.java:13)
      Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)
              at java.security.AccessControlContext.checkPermission(AccessControlContext.java:321)
              at java.security.AccessController.checkPermission(AccessController.java:546)
              at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
              at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java:594)
              at java.lang.ClassLoader.<init>(ClassLoader.java:225)
              at java.util.ResourceBundle$RBClassLoader.<init>(ResourceBundle.java:425)
              at java.util.ResourceBundle$RBClassLoader.<clinit>(ResourceBundle.java:422)
              ... 7 more
      java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)
              at java.security.AccessControlContext.checkPermission(AccessControlContext.java:321)
              at java.security.AccessController.checkPermission(AccessController.java:546)
              at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
              at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java:594)
              at java.lang.ClassLoader.<init>(ClassLoader.java:225)
              at java.util.ResourceBundle$RBClassLoader.<init>(ResourceBundle.java:425)
              at java.util.ResourceBundle$RBClassLoader.<clinit>(ResourceBundle.java:422)
              at java.util.ResourceBundle.getLoader(ResourceBundle.java:411)
              at java.util.ResourceBundle.getBundle(ResourceBundle.java:771)
              at com.sun.org.apache.xerces.internal.util.SAXMessageFormatter.formatMessage(SAXMessageFormatter.java:53)
              at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.getProperty(AbstractSAXParser.java:2060)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.setProperty(SAXParserImpl.java:467)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl.setProperty(SAXParserImpl.java:263)
              at Foo.main(Foo.java:13)



      java version "1.5.0"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0-b64)
      Java HotSpot(TM) Client VM (build 1.5.0-b64, mixed mode)
      > javac Foo.java
      > java -Djava.security.manager Foo
      org.xml.sax.SAXNotRecognizedException: Property 'foo' is not recognized.
              at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.setPrope
      rty(AbstractSAXParser.java:1849)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl.setProperty(SAX
      ParserImpl.java:384)
              at Foo.main(Foo.java:12)
      Exception in thread "main" java.lang.NullPointerException
              at Foo.main(Foo.java:15)

      java version "1.6.0-rc"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.6.0-rc-b62)
      Java HotSpot(TM) Client VM (build 1.6.0-rc-b62, mixed mode)
      > javac Foo.java
      > java -Djava.security.manager Foo
      java.lang.ExceptionInInitializerError
              at java.util.ResourceBundle.getLoader(ResourceBundle.java:411)
              at java.util.ResourceBundle.getBundle(ResourceBundle.java:771)
              at com.sun.org.apache.xerces.internal.util.SAXMessageFormatter.formatMes
      sage(SAXMessageFormatter.java:53)
              at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.getPrope
      rty(AbstractSAXParser.java:2060)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.s
      etProperty(SAXParserImpl.java:467)
              at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl.setProperty(SAX
      ParserImpl.java:263)
              at Foo.main(Foo.java:12)
      Caused by: java.security.AccessControlException: access denied (java.lang.Runtim
      ePermission createClassLoader)
              at java.security.AccessControlContext.checkPermission(AccessControlConte
      xt.java:321)
              at java.security.AccessController.checkPermission(AccessController.java:
      546)
              at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
              at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java
      :594)
              at java.lang.ClassLoader.<init>(ClassLoader.java:225)
              at java.util.ResourceBundle$RBClassLoader.<init>(ResourceBundle.java:425
      )
              at java.util.ResourceBundle$RBClassLoader.<clinit>(ResourceBundle.java:4
      22)
              ... 7 more

      REPRODUCIBILITY :
      This bug can be reproduced always.

      ---------- BEGIN SOURCE ----------
      import javax.xml.parsers.SAXParser;
      import javax.xml.parsers.SAXParserFactory;

      public class Foo {

              public static void main(String[] args) throws Throwable {
                      try {
                      SAXParserFactory spf = SAXParserFactory.newInstance();
                      spf.setNamespaceAware(true);
                      spf.setValidating(true);
                      SAXParser sp = spf.newSAXParser();
                      sp.setProperty("foo", "bar");
                      } catch (Throwable e) {
                              e.printStackTrace();
                              e.getCause().printStackTrace();
                              }

              }

      }
      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      Grant all code permission to create a classloader

      Release Regression From : 5.0
      The above release value was the last known release where this
      bug was known to work. Since then there has been a regression.

        Attachments

          Activity

            People

            Assignee:
            okutsu Masayoshi Okutsu
            Reporter:
            rmandalasunw Ranjith Mandala (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: