On 02/10/2013 18:02, Doug Lea wrote:
On 10/02/2013 12:29 PM, Martin Buchholz wrote:
FutureTask.cancel(true) invokes thread.interrupt on the thread (if any)
currently running the task.
This should succeed even if modifyThread permission is denied by the
security
manager.
We haven't interpreted "should" in this way in the past here or in
related contexts, but I don't see are reason not to, pending any
objections by security folks.
Objection. I can straightaway see a way of getting an instance of a
JDK-8 FutureTask with a runner that is not current running the
FutureTask.run, without so much as needing a race. That would allow an
adversary to to interrupt a thread in contravention of the security policy.
Tom
