All: Several of us had seemingly gone back and forth trying to decide the best approach to privileged actions in the BVal codebase. The approaches we tried were verbose, less-than-secure, or (my own) put additional requirements on the end user. My work at https://svn.apache.org/repos/asf/bval/branches/privileged2 uses https://github.com/mbenson/privileged-method-weaver to attempt to resolve all these issues. I have completely gotten rid of the SecureActions and PrivilegedActions classes in favor of small private methods in the consuming classes. These are annotated with a single, class-level-retained @Privileged annotation, and a Maven plugin (also available as an Antlib) post-processes the classfiles courtesy of xbean-finder and javassist. It'd be great if some of you who run BVal in secured environments could give it a spin.
Thanks, Matt
