Mercurial > hg > release > icedtea6-1.12

# HG changeset patch
# User andrew
# Date 1371556350 18000
# Node ID 5fcac0fe0ace5584b980a35afb582519f8434617
# Parent  97f318cdfb834385beb7370348582daebccc8987
8009554: Improve SerialJavaObject.getFields
Reviewed-by: alanb, skoivu

diff --git a/src/share/classes/javax/sql/rowset/serial/SerialJavaObject.java b/src/share/classes/javax/sql/rowset/serial/SerialJavaObject.java
--- openjdk/jdk/src/share/classes/javax/sql/rowset/serial/SerialJavaObject.java
+++ openjdk/jdk/src/share/classes/javax/sql/rowset/serial/SerialJavaObject.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,6 +30,7 @@
 import java.util.Map;
 import java.lang.reflect.*;
 import javax.sql.rowset.RowSetWarning;
+import sun.reflect.Reflection;

 /**
  * A serializable mapping in the Java programming language of an SQL
@@ -136,10 +137,12 @@
      * @return an array of <code>Field</code> objects
      * @throws SerialException if an error is encountered accessing
      * the serialized object
+     * @see Class#getFields
      */
     public Field[] getFields() throws SerialException {
         if (fields != null) {
             Class c = this.obj.getClass();
+            checkPackageAccess(c);
             //the following has to be commented before mustang integration
             //return c.getFields();
             //the following has to be uncommented before mustang integration
@@ -172,4 +175,38 @@
         }
         chain.add(e);
     }
+
+    /*
+     * Check if the caller is allowed to access the specified class's package.  If access is denied,
+     * throw a SecurityException.
+     *
+     */
+    private void checkPackageAccess(Class<?> clz) {
+        SecurityManager s = System.getSecurityManager();
+        if (s != null) {
+            if (sun.reflect.misc.ReflectUtil.needsPackageAccessCheck(
+                    getCallerClassLoader(), clz.getClassLoader())) {
+                String name = clz.getName();
+                int i = name.lastIndexOf('.');
+                if (i != -1) {
+                    s.checkPackageAccess(name.substring(0, i));
+                }
+            }
+        }
+    }
+
+    /* Internal method used to get the caller's caller class loader.
+     * Caution is required if you attempt to make changes as this method assumes
+     * the following stack frame count:
+     * 0: Reflection
+     * 1: getCallerClassLoader
+     * 2: checkPackageAccess
+     * 3: getFields
+     * 4: caller of getFields
+     */
+    private static ClassLoader getCallerClassLoader() {
+        Class<?> cc = Reflection.getCallerClass(4);
+        ClassLoader cl = (cc != null) ? cc.getClassLoader() : null;
+        return cl;
+    }
 }
author	Andrew John Hughes <gnu.andrew@redhat.com>
date	Sat, 22 Jun 2013 16:38:24 -0500
parents
children