JBossDeveloper

"adrian@jboss.org" wrote:
Also I don't see a test in the kernel project that is validating
that you can't use the xml deployment (or programmatic deployment)
to bypass the private field access.

"adrian@jboss.org" wrote:
In case its not clear

"adrian@jboss.org" wrote:

"alesj" wrote:

"adrian@jboss.org" wrote:
In case its not clear

Nope, not clear. :-)
OK, I'm glad I didn't introduce security hole :-), but I don't see why your example will fail with the current code?

It won't fail with the current code.

"adrian@jboss.org" wrote:
Write the tests then you'll understand.

 public void testFieldAcess() throws Throwable
 {
 final FieldsClass tester = new FieldsClass();

 final ReflectFieldInfoImpl impl = new ReflectFieldInfoImpl();
 SecurityManager sm = suspendSecurity();
 try
 {
 // e.g. I can't do setAccesible - although you can here, with the current disabled security
 Field myField = FieldsClass.class.getDeclaredField("privString");
 impl.setField(myField); // So I'll use this hole
 }
 finally
 {
 resumeSecurity(sm);
 }

 Field field = impl.getField(); // This should have an access check
 field.set(tester, "foobar");
 assertEquals("foobar", tester.getPrivString());

 Runnable runnable = new Runnable()
 {
 public void run()
 {
 try
 {
 Field fi = impl.getField(); // This should have an access check
 fi.set(tester, "something"); // this should check for caller
 }
 catch (Throwable t)
 {
 throw new RuntimeException(t);
 }
 }
 };
 ErrorHolderThread other = new ErrorHolderThread(runnable);
 other.start();
 other.join();
 // we should get an error here - but we don't :-(
 assertNotNull("Should get access restriction exception.", other.getError());
 RuntimeException re = assertInstanceOf(other.getError(), RuntimeException.class);
 Throwable cause = re.getCause();
 assertNotNull(cause);
 assertInstanceOf(cause, AccessControlException.class, false);
 }

"alesj" wrote:

"adrian@jboss.org" wrote:
Write the tests then you'll understand.

OK, the test is here, but it doesn't behave as I expect it to behave. :-(

 public void testFieldAcessFromMain() throws Throwable
 {
 final FieldsClass tester = new FieldsClass();
 final ReflectFieldInfoImpl impl = new ReflectFieldInfoImpl();

 // I can't do setAccesible
 Field field = FieldsClass.class.getDeclaredField("privString");
 // let's try accessible
 try
 {
 field.setAccessible(true);
 fail("Should not be here.");
 }
 catch (Throwable t)
 {
 assertInstanceOf(t, AccessControlException.class);
 }
 // ok, setAccessible not set, so set should also fail
 try
 {
 field.set(tester, "foobar");
 fail("Should not be here.");
 }
 catch (Throwable t)
 {
 assertInstanceOf(t, IllegalAccessException.class);
 }

 impl.setField(field); // So I'll use this hole
 field = impl.getField(); // This should have an access check
 // why does this work?!?
 field.set(tester, "foobar");
 assertEquals("foobar", tester.getPrivString());

"adrian@jboss.org" wrote:
Don't worry about it, I'll write the tests and fix any problem(s) found.

"adrian@jboss.org" wrote:

Just confirm to me that it works besides the potential security hole? :-)

"adrian@jboss.org" wrote:

"alesj" wrote:

And there is still that issue with AOP proxies and field injection:
- http://www.jboss.org/index.html?module=bb&op=viewtopic&t=132169

Do you or Kabir have a test?