On 11/04/2016 16:57, Jochen Theodorou wrote:
:
Can it be registered via registerDriver? That actually made me wonder
why exactly we require the system loader here in the first place.
Part of the problem is DriverManager#getConnection, which is
@CallerSensitive. So if I want to get a connection from an arbitrary
loader, it has to be the same loader, that registered the driver, or a
higher one. Here getConnection is done from library code, with a
different loader. So it cannot work that way... sigh... not reliably.
It is indeed surprising that these methods are @CS. It seems this has
been the case since JDK 1.1/1.2 then the java.sql API was changed from
using the security context. It needs to be re-examined along an
investigation on the impact of changing this after all these years.
As Lance Andersen often points outs, most EE/web applications are likely
to be using javax.sql.DataSource rather than java.sql.Driver these days.
-Alan.
