Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-5955

Old version of cglib 2.0 creates problems with Java 2 security in WebSphere 5.1

    XMLWordPrintable

Details

    Description

      From a customer:

      Confluence includes an old version of cglib-2.0.jar, that does not appear to be the final version, possibly a release candidate version. Upgrading to cglib-full-2.0.2.jar should fix the problem:
      http://www.ibiblio.org/maven/cglib/jars/cglib-full-2.0.2.jar

      The final version of cglib-2.0 makes "generated classes have the same protection domain as cglib.jar (have the same signer and code base). It can be useful if hibernate is used in app server with security manager or for Web Start applications."
      http://forum.hibernate.org/viewtopic.php?p=2190363

      With the old version of cglib, you will get the following error in WebSphere 5.1, even with full permissions in your policy file:

      [4/19/06 9:05:51:921 CDT] 143a23d3 SecurityManag W SECJ0314W: Current Java 2 Security policy reported a potential violation of Java 2 Security Permission. Please refer to Problem Determination Guide for further information.
      Permission:
      accessDeclaredMembers : access denied (java.lang.RuntimePermission accessDeclaredMembers)
      Code:
      com.atlassian.user.impl.hibernate.DefaultHibernateGroup$$EnhancerByCGLIB$$543a4eb1 in

      {null code URL}

      Stack Trace:
      java.security.AccessControlException: access denied (java.lang.RuntimePermission accessDeclaredMembers)
      at java.security.AccessControlContext.checkPermission(AccessControlContext.java(Compiled Code))
      at java.security.AccessController.checkPermission(AccessController.java(Compiled Code))
      at java.lang.SecurityManager.checkPermission(SecurityManager.java(Compiled Code))
      at com.ibm.ws.security.core.SecurityManager.checkPermission(SecurityManager.java(Compiled Code))
      at java.lang.SecurityManager.checkMemberAccess(SecurityManager.java(Compiled Code))
      at java.lang.Class.checkMemberAccess(Class.java(Compiled Code))
      at java.lang.Class.getDeclaredMethods(Class.java:1240)
      at net.sf.cglib.core.ReflectUtils.addAllMethods(ReflectUtils.java:341)
      at net.sf.cglib.core.ReflectUtils.addAllMethods(ReflectUtils.java:344)
      at net.sf.cglib.core.ReflectUtils.addAllMethods(ReflectUtils.java:344)
      at net.sf.cglib.core.ReflectUtils.addAllMethods(ReflectUtils.java:344)
      at net.sf.cglib.core.ReflectUtils.addAllMethods(ReflectUtils.java:344)
      at net.sf.cglib.reflect.FastClassEmitter.<init>(FastClassEmitter.java:101)
      at net.sf.cglib.reflect.FastClass$Generator.generateClass(FastClass.java:98)
      at net.sf.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:186)
      at net.sf.cglib.reflect.FastClass$Generator.create(FastClass.java:90)
      at net.sf.cglib.proxy.MethodProxy.helper(MethodProxy.java:115)
      at net.sf.cglib.proxy.MethodProxy.create(MethodProxy.java:87)
      at com.atlassian.user.impl.hibernate.DefaultHibernateGroup$$EnhancerByCGLIB$$543a4eb1.<clinit>(<generated>)

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              christopher.owen@atlassian.com Christopher Owen [Atlassian]
              Votes:
              1 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: