While writing the new security manager section for the book update, I tried to check the "requires"
security checkpoint by using a dynamic requires and replace the required package with a different
one following the rexxref.pdf documentation on the security manager. Unfortunately, this does not
work, the REQUIRES security checkpoint does not honor the entries in the directory argument that got
changed by the security manager according to the documentation (please note: the 5.2.0 documentation
of the REQUIRES message wrongly indicates that returning .false would indicate that the argument
directory got changed and therefore the NAME and SECURITYMANAGER entry need to be honored). See
enclosed example and run it as: "rexx launcher.orx myProgram1dynamicRequires.orx", it returns .true
to indicate that the REQUIRES method handled the message and the entries in the argument's directory
need to be honored (changing the return value to .false does not change the behaviour).
In effect this bug has been already reported in the context of
<https://sourceforge.net/p/oorexx/bugs/1507/>.
So definitely the security manager, the security checkpoints need to be (finally!) thoroughly
analyzed, checked and fixed systematically (especially the REQUIRES security checkpoint not being
triggered in the static form, and even if triggered in the dynamic form does not honor changes in
the REQUIRES method).
---rony
parse arg fn .
if fn="" then
do
say "you must supply a file name!"
exit -1
end
-- have this package/program supervise from now on with an auditor security manager
.context~package~setSecurityManager(.auditor~new)
-- this will already be reported (environment symbol)
say "line #" .line": accessing environment"
say "supervising" pp(fn)
code=.file~readlines(fn) -- read code into array
do counter c1 secManObj over .auditor~new, .nil
say "="~copies(79)
if secManObj~isNil then leave
say c1"." secManObj
do counter c2 clz over .routine, .nil -- , .method, .package
if clz~isNil then leave
name="test"clz~id
r=clz~new(name, code) -- create object
say " " c2"." name": ---> about to set the security manager"
r~setSecurityManager(secManObj)
say " " c2"." name": about to call ..."
r~call
say "---"
say
end
say "="~copies(79)
say
end
/* ------------------------------------------------------------- */
::class auditor public -- report a supervise action
::method unknown
use arg methName, methArgs
say self": received security message:" pp(methName) -
"entries in argument:" ppArgs(methArgs[1])
return .false -- indicate we did not handle this
::method requires
use arg infoDir
say self": received security message:" pp("REQUIRES") -
"entries in argument:" ppArgs(infoDir)
if infoDir~name="json.cls" then
infoDir~name="replJson.cls" -- use this package instead
infoDir~securitymanager=self -- assign this security manager
say "---> REQUIRES, returning:" ppArgs(infoDir) -- show current content of directory
return .true -- should cause 'replJson.cls' to be required instead
-- return .false
/* ------------------------------------------------------------- */
::routine ppArgs -- pretty print arguments
use arg dir
mb=.mutableBuffer~new
do counter c idx over dir~allIndexes~sort
mb~append((c>1)~?(', ','') , '"', idx, '"="', dir[idx]~string, '"')
end
return mb~string
/* ------------------------------------------------------------- */
::routine pp public
return "["arg(1)"]"
say "replJson.cls"
say ".local~hi:" .local~hi
::class Json public
::method define class
say "in replJson: define-class method ..."
::requires "json.cls"
/* myProgram.rex: to be supervised */
/* Agent */
"echo Hello There"
call rxfuncadd "rxcalcsqrt", "rxmath", "rxcalcsqrt"
say result
say syssleep(1)
say linein("./profile")
say .methods
say "*** dynamically requiring json.cls ..."
.context~package~addPackage(.package~new("json.cls"))
.json~define("")
say "line #" .line":" .context~name
_______________________________________________
Oorexx-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/oorexx-devel
