Skip to content

Commit 3aaaeb2

Browse files
sbordetsbordet
committed
Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
2 parents b96a605 + 2c61011 commit 3aaaeb2

9 files changed

Lines changed: 257 additions & 168 deletions

File tree

‎jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/DefaultAuthConfigFactory.java‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import jakarta.security.auth.message.config.AuthConfigFactory;
2323
import jakarta.security.auth.message.config.AuthConfigProvider;
2424
import jakarta.security.auth.message.config.RegistrationListener;
25+
import org.eclipse.jetty.util.security.SecurityUtils;
2526
import org.slf4j.Logger;
2627
import org.slf4j.LoggerFactory;
2728

@@ -59,9 +60,7 @@ public AuthConfigProvider getConfigProvider(String layer, String appContext, Reg
5960
@Override
6061
public String registerConfigProvider(String className, Map properties, String layer, String appContext, String description)
6162
{
62-
SecurityManager sm = System.getSecurityManager();
63-
if (sm != null)
64-
sm.checkPermission(AuthConfigFactory.providerRegistrationSecurityPermission);
63+
checkPermission();
6564

6665
String key = getKey(layer, appContext);
6766
AuthConfigProvider configProvider = createConfigProvider(className, properties);
@@ -75,9 +74,7 @@ public String registerConfigProvider(String className, Map properties, String la
7574
@Override
7675
public String registerConfigProvider(AuthConfigProvider provider, String layer, String appContext, String description)
7776
{
78-
SecurityManager sm = System.getSecurityManager();
79-
if (sm != null)
80-
sm.checkPermission(AuthConfigFactory.providerRegistrationSecurityPermission);
77+
checkPermission();
8178

8279
String key = getKey(layer, appContext);
8380
DefaultRegistrationContext context = new DefaultRegistrationContext(provider, layer, appContext, description, false);
@@ -90,9 +87,7 @@ public String registerConfigProvider(AuthConfigProvider provider, String layer,
9087
@Override
9188
public boolean removeRegistration(String registrationID)
9289
{
93-
SecurityManager sm = System.getSecurityManager();
94-
if (sm != null)
95-
sm.checkPermission(AuthConfigFactory.providerRegistrationSecurityPermission);
90+
checkPermission();
9691

9792
DefaultRegistrationContext registrationContext = _registrations.remove(registrationID);
9893
if (registrationContext == null)
@@ -105,9 +100,7 @@ public boolean removeRegistration(String registrationID)
105100
@Override
106101
public String[] detachListener(RegistrationListener listener, String layer, String appContext)
107102
{
108-
SecurityManager sm = System.getSecurityManager();
109-
if (sm != null)
110-
sm.checkPermission(AuthConfigFactory.providerRegistrationSecurityPermission);
103+
checkPermission();
111104

112105
List<String> registrationIds = new ArrayList<>();
113106
for (DefaultRegistrationContext registration : _registrations.values())
@@ -144,13 +137,16 @@ public RegistrationContext getRegistrationContext(String registrationID)
144137
@Override
145138
public void refresh()
146139
{
147-
SecurityManager sm = System.getSecurityManager();
148-
if (sm != null)
149-
sm.checkPermission(AuthConfigFactory.providerRegistrationSecurityPermission);
140+
checkPermission();
150141

151142
// TODO: maybe we should re-construct providers created from classname.
152143
}
153144

145+
private static void checkPermission()
146+
{
147+
SecurityUtils.checkPermission(providerRegistrationSecurityPermission);
148+
}
149+
154150
private static String getKey(String layer, String appContext)
155151
{
156152
return layer + "/" + appContext;

‎jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java‎

Lines changed: 12 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@
2020
import java.net.URI;
2121
import java.net.URL;
2222
import java.net.URLClassLoader;
23-
import java.security.AccessController;
24-
import java.security.PrivilegedAction;
2523
import java.util.ArrayList;
2624
import java.util.Arrays;
2725
import java.util.Collections;
@@ -87,6 +85,7 @@
8785
import org.eclipse.jetty.util.component.Graceful;
8886
import org.eclipse.jetty.util.component.LifeCycle;
8987
import org.eclipse.jetty.util.resource.Resource;
88+
import org.eclipse.jetty.util.security.SecurityUtils;
9089
import org.slf4j.Logger;
9190
import org.slf4j.LoggerFactory;
9291

@@ -219,7 +218,7 @@ private enum ProtectedTargetType
219218
private int _maxFormKeys = Integer.getInteger(MAX_FORM_KEYS_KEY, DEFAULT_MAX_FORM_KEYS);
220219
private int _maxFormContentSize = Integer.getInteger(MAX_FORM_CONTENT_SIZE_KEY, DEFAULT_MAX_FORM_CONTENT_SIZE);
221220
private boolean _compactPath = false;
222-
private boolean _usingSecurityManager = System.getSecurityManager() != null;
221+
private boolean _usingSecurityManager = getSecurityManager() != null;
223222

224223
private final List<EventListener> _programmaticListeners = new CopyOnWriteArrayList<>();
225224
private final List<ServletContextListener> _servletContextListeners = new CopyOnWriteArrayList<>();
@@ -326,7 +325,7 @@ public boolean isUsingSecurityManager()
326325

327326
public void setUsingSecurityManager(boolean usingSecurityManager)
328327
{
329-
if (usingSecurityManager && System.getSecurityManager() == null)
328+
if (usingSecurityManager && getSecurityManager() == null)
330329
throw new IllegalStateException("No security manager");
331330
_usingSecurityManager = usingSecurityManager;
332331
}
@@ -2111,6 +2110,11 @@ public void clearAliasChecks()
21112110
_aliasChecks.clear();
21122111
}
21132112

2113+
private static Object getSecurityManager()
2114+
{
2115+
return SecurityUtils.getSecurityManager();
2116+
}
2117+
21142118
/**
21152119
* Context.
21162120
* <p>
@@ -2558,19 +2562,17 @@ public ClassLoader getClassLoader()
25582562
{
25592563
// check to see if the classloader of the caller is the same as the context
25602564
// classloader, or a parent of it, as required by the javadoc specification.
2561-
2562-
// Wrap in a PrivilegedAction so that only Jetty code will require the
2563-
// "createSecurityManager" permission, not also application code that calls this method.
2564-
Caller caller = AccessController.doPrivileged((PrivilegedAction<Caller>)Caller::new);
2565-
ClassLoader callerLoader = caller.getCallerClassLoader(2);
2565+
ClassLoader callerLoader = StackWalker.getInstance(StackWalker.Option.RETAIN_CLASS_REFERENCE)
2566+
.getCallerClass()
2567+
.getClassLoader();
25662568
while (callerLoader != null)
25672569
{
25682570
if (callerLoader == _classLoader)
25692571
return _classLoader;
25702572
else
25712573
callerLoader = callerLoader.getParent();
25722574
}
2573-
System.getSecurityManager().checkPermission(new RuntimePermission("getClassLoader"));
2575+
SecurityUtils.checkPermission(new RuntimePermission("getClassLoader"));
25742576
return _classLoader;
25752577
}
25762578
}
@@ -3100,17 +3102,4 @@ public static interface ContextScopeListener extends EventListener
31003102
*/
31013103
void exitScope(Context context, Request request);
31023104
}
3103-
3104-
private static class Caller extends SecurityManager
3105-
{
3106-
public ClassLoader getCallerClassLoader(int depth)
3107-
{
3108-
if (depth < 0)
3109-
return null;
3110-
Class<?>[] classContext = getClassContext();
3111-
if (classContext.length <= depth)
3112-
return null;
3113-
return classContext[depth].getClassLoader();
3114-
}
3115-
}
31163105
}

‎jetty-slf4j-impl/src/main/java/org/eclipse/jetty/logging/JettyLoggerConfiguration.java‎

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@
1616
import java.io.IOException;
1717
import java.io.InputStream;
1818
import java.net.URL;
19-
import java.security.AccessController;
20-
import java.security.PrivilegedAction;
2119
import java.util.Arrays;
2220
import java.util.Locale;
2321
import java.util.Properties;
@@ -161,29 +159,26 @@ public TimeZone getTimeZone(String key)
161159
*/
162160
public JettyLoggerConfiguration load(ClassLoader loader)
163161
{
164-
return AccessController.doPrivileged((PrivilegedAction<JettyLoggerConfiguration>)() ->
162+
// First see if the jetty-logging.properties object exists in the classpath.
163+
// * This is an optional feature used by embedded mode use, and test cases to allow for early
164+
// * configuration of the Log class in situations where access to the System.properties are
165+
// * either too late or just impossible.
166+
load(readProperties(loader, "jetty-logging.properties"));
167+
168+
// Next see if an OS specific jetty-logging.properties object exists in the classpath.
169+
// This really for setting up test specific logging behavior based on OS.
170+
String osName = System.getProperty("os.name");
171+
if (osName != null && osName.length() > 0)
165172
{
166-
// First see if the jetty-logging.properties object exists in the classpath.
167-
// * This is an optional feature used by embedded mode use, and test cases to allow for early
168-
// * configuration of the Log class in situations where access to the System.properties are
169-
// * either too late or just impossible.
170-
load(readProperties(loader, "jetty-logging.properties"));
171-
172-
// Next see if an OS specific jetty-logging.properties object exists in the classpath.
173-
// This really for setting up test specific logging behavior based on OS.
174-
String osName = System.getProperty("os.name");
175-
if (osName != null && osName.length() > 0)
176-
{
177-
// NOTE: cannot use jetty-util's StringUtil.replace() as it may initialize logging itself.
178-
osName = osName.toLowerCase(Locale.ENGLISH).replace(' ', '-');
179-
load(readProperties(loader, "jetty-logging-" + osName + ".properties"));
180-
}
173+
// NOTE: cannot use jetty-util's StringUtil.replace() as it may initialize logging itself.
174+
osName = osName.toLowerCase(Locale.ENGLISH).replace(' ', '-');
175+
load(readProperties(loader, "jetty-logging-" + osName + ".properties"));
176+
}
181177

182-
// Now load the System.properties as-is into the properties,
183-
// these values will override any key conflicts in properties.
184-
load(System.getProperties());
185-
return this;
186-
});
178+
// Now load the System.properties as-is into the properties,
179+
// these values will override any key conflicts in properties.
180+
load(System.getProperties());
181+
return this;
187182
}
188183

189184
public String getString(String key, String defValue)

‎jetty-util/src/main/java/org/eclipse/jetty/util/MemoryUtils.java‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@
1313

1414
package org.eclipse.jetty.util;
1515

16-
import java.security.AccessController;
17-
import java.security.PrivilegedAction;
18-
1916
/**
2017
* MemoryUtils provides an abstraction over memory properties and operations.
2118
*/
@@ -25,18 +22,11 @@ public class MemoryUtils
2522

2623
static
2724
{
28-
final int defaultValue = 64;
25+
int defaultValue = 64;
2926
int value = defaultValue;
3027
try
3128
{
32-
value = Integer.parseInt(AccessController.doPrivileged(new PrivilegedAction<String>()
33-
{
34-
@Override
35-
public String run()
36-
{
37-
return System.getProperty("org.eclipse.jetty.util.cacheLineBytes", String.valueOf(defaultValue));
38-
}
39-
}));
29+
value = Integer.parseInt(System.getProperty("org.eclipse.jetty.util.cacheLineBytes", String.valueOf(defaultValue)));
4030
}
4131
catch (Exception ignored)
4232
{

‎jetty-util/src/main/java/org/eclipse/jetty/util/TypeUtil.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,7 @@
2626
import java.net.URI;
2727
import java.net.URISyntaxException;
2828
import java.net.URL;
29-
import java.security.AccessController;
3029
import java.security.CodeSource;
31-
import java.security.PrivilegedAction;
3230
import java.security.ProtectionDomain;
3331
import java.util.ArrayList;
3432
import java.util.Arrays;
@@ -671,7 +669,7 @@ public static URI getCodeSourceLocation(Class<?> clazz)
671669
{
672670
try
673671
{
674-
ProtectionDomain domain = AccessController.doPrivileged((PrivilegedAction<ProtectionDomain>)() -> clazz.getProtectionDomain());
672+
ProtectionDomain domain = clazz.getProtectionDomain();
675673
if (domain != null)
676674
{
677675
CodeSource source = domain.getCodeSource();

‎jetty-util/src/main/java/org/eclipse/jetty/util/security/SecurityUtils.java‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
//
2+
// ========================================================================
3+
// Copyright (c) 1995 Mort Bay Consulting Pty Ltd and others.
4+
//
5+
// This program and the accompanying materials are made available under the
6+
// terms of the Eclipse Public License v. 2.0 which is available at
7+
// https://www.eclipse.org/legal/epl-2.0, or the Apache License, Version 2.0
8+
// which is available at https://www.apache.org/licenses/LICENSE-2.0.
9+
//
10+
// SPDX-License-Identifier: EPL-2.0 OR Apache-2.0
11+
// ========================================================================
12+
//
13+
14+
package org.eclipse.jetty.util.security;
15+
16+
import java.lang.invoke.MethodHandle;
17+
import java.lang.invoke.MethodHandles;
18+
import java.lang.invoke.MethodType;
19+
import java.security.Permission;
20+
import java.security.PrivilegedAction;
21+
22+
/**
23+
* <p>Collections of utility methods to deal with the scheduled removal
24+
* of the security classes defined by <a href="https://openjdk.org/jeps/411">JEP 411</a>.</p>
25+
*/
26+
public class SecurityUtils
27+
{
28+
private static final MethodHandle doPrivileged = lookup();
29+
30+
private static MethodHandle lookup()
31+
{
32+
try
33+
{
34+
// Use reflection to work with Java versions that have and don't have AccessController.
35+
Class<?> klass = ClassLoader.getPlatformClassLoader().loadClass("java.security.AccessController");
36+
MethodHandles.Lookup lookup = MethodHandles.lookup();
37+
return lookup.findStatic(klass, "doPrivileged", MethodType.methodType(Object.class, PrivilegedAction.class));
38+
}
39+
catch (Throwable x)
40+
{
41+
return null;
42+
}
43+
}
44+
45+
/**
46+
* @return the current security manager, if available
47+
*/
48+
public static Object getSecurityManager()
49+
{
50+
try
51+
{
52+
// Use reflection to work with Java versions that have and don't have SecurityManager.
53+
return System.class.getMethod("getSecurityManager").invoke(null);
54+
}
55+
catch (Throwable ignored)
56+
{
57+
return null;
58+
}
59+
}
60+
61+
/**
62+
* <p>Checks the given permission, if the {@link #getSecurityManager() security manager}
63+
* is set.</p>
64+
*
65+
* @param permission the permission to check
66+
* @throws SecurityException if the permission check fails
67+
*/
68+
public static void checkPermission(Permission permission) throws SecurityException
69+
{
70+
Object securityManager = SecurityUtils.getSecurityManager();
71+
if (securityManager == null)
72+
return;
73+
try
74+
{
75+
securityManager.getClass().getMethod("checkPermission")
76+
.invoke(securityManager, permission);
77+
}
78+
catch (SecurityException x)
79+
{
80+
throw x;
81+
}
82+
catch (Throwable ignored)
83+
{
84+
}
85+
}
86+
87+
/**
88+
* <p>Runs the given action with the calling context restricted
89+
* to just the calling frame, not all the frames in the stack.</p>
90+
*
91+
* @param action the action to run
92+
* @return the result of running the action
93+
* @param <T> the type of the result
94+
*/
95+
public static <T> T doPrivileged(PrivilegedAction<T> action)
96+
{
97+
// Keep this method short and inlineable.
98+
MethodHandle methodHandle = doPrivileged;
99+
if (methodHandle == null)
100+
return action.run();
101+
return doPrivileged(methodHandle, action);
102+
}
103+
104+
@SuppressWarnings("unchecked")
105+
private static <T> T doPrivileged(MethodHandle doPrivileged, PrivilegedAction<T> action)
106+
{
107+
try
108+
{
109+
return (T)doPrivileged.invoke(action);
110+
}
111+
catch (RuntimeException | Error x)
112+
{
113+
throw x;
114+
}
115+
catch (Throwable x)
116+
{
117+
throw new RuntimeException(x);
118+
}
119+
}
120+
121+
private SecurityUtils()
122+
{
123+
}
124+
}

0 commit comments

Comments
 (0)