https://bz.apache.org/bugzilla/show_bug.cgi?id=62080
Bug ID: 62080
Summary: EL Util class should have doPrivledge block
Product: Tomcat 9
Version: unspecified
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: EL
Assignee: dev@tomcat.apache.org
Reporter: jsarto...@hotmail.com
Target Milestone: -----
The javax.el.Util class can lead to an AccessControlException in the
getExpressionFactory() method is security is enabled.
I believe the call to get the classloader:
ClassLoader tccl = Thread.currentThread().getContextClassLoader();
should be wrapped in a doPrivileged block:
ClassLoader tccl;
if (System.getSecurityManager() != null) {
tccl = AccessController.doPrivileged(new
PrivilegedAction<ClassLoader>() {
@Override
public ClassLoader run() {
return Thread.currentThread().getContextClassLoader();
}
});
} else {
tccl = Thread.currentThread().getContextClassLoader();
}
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
