Missing priviledged actions for isolating caller from permission checks
-----------------------------------------------------------------------
Key: JBAOP-95
URL: http://jira.jboss.com/jira/browse/JBAOP-95
Project: JBoss AOP
Type: Bug
Reporter: Scott M Stark
The current security related aspects are not isolating their operations that
are subject to permission checks from the caller permission assigment using
priviledged actions. For example, the
org.jboss.aspects.security.AuthenticationInterceptor is using the
org.jboss.security.SecurityAssociation and all of its methods are subject to
permission checks. This call:
principal = SecurityAssociation.getPrincipal();
Should be:
principal = SecurityActions.getPrincipal();
where the SecurityActions class is a package private class like the following:
class SecurityActions
{
interface PrincipalActions
{
// Used when running under a security manager
PrincipalActions PRIVILEGED = new PrincipalActions()
{
private final PrivilegedAction exAction = new PrivilegedAction()
{
public Object run()
{
return SecurityAssociation.getPrincipal();
}
};
public Principal getPrincipal()
{
return (Principal) AccessController.doPrivileged(exAction);
}
};
// Used when not running under a security manager
PrincipalActions NON_PRIVILEGED = new PrincipalActions()
{
public Principal getPrincipal()
{
return SecurityAssociation.getPrincipal();
}
};
Principal getPrincipal();
}
static Principal getPrincipal()
{
if(System.getSecurityManager() == null)
{
return PrincipalActions.NON_PRIVILEGED.getPrincipal();
}
else
{
return PrincipalActions.PRIVILEGED.getPrincipal();
}
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
JBoss-Development mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jboss-development
