Hi,

We are using the SystemProperties class throughout the Classpath code to
access system properties and avoid the security checks in
java.lang.System. However, I come to think that this is no good the way
it is. This class is public and nothing prevents use of this class from
application code. This way it'd very easy for an application to
cirumvent the protection in java.lang.System by using the
SystemProperties class directly. Not that I think that GNU Classpath
would be an interesting target for attacking, but shouldn't we avoid
such issues from the start? Please correct me if I missed some important
aspect here.

/Roman



Reply via email to