[
https://issues.apache.org/jira/browse/JSPWIKI-129?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135866#comment-18135866
]
Arturo Bernal commented on JSPWIKI-129:
---------------------------------------
A pull request is open: https://github.com/apache/jspwiki/pull/552. Permissions
are checked against the policy of the wiki only, for the roles and the
principals of the session, and no longer through AccessController and the
security policy of the JVM; a GroupPermission that is not granted as such is
checked again as the groupmember permission of its group when the Subject of
the session is a member of that group. The security policy of the JVM
(java.security.policy) is no longer consulted, which is a change of behaviour
that the pull request describes. AuthorizationManagerTest and
GroupPermissionTest pass on its branch (40 tests) and the tests of the pull
request do not pass on master.
> JSPWIki cannot run under a security manager
> -------------------------------------------
>
> Key: JSPWIKI-129
> URL: https://issues.apache.org/jira/browse/JSPWIKI-129
> Project: JSPWiki
> Issue Type: Bug
> Components: Authentication & Authorization
> Affects Versions: 2.4.104, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.8, 2.8.1,
> 2.8.2, 2.8.3, 2.8.4
> Environment: All
> Reporter: Andrew R. Jaquith
> Assignee: Andrew R. Jaquith
> Priority: Major
> Labels: pull-request-available
>
> JSPWiki cannot be used when running a security manager. Containers that run
> by default with a security manager include Oracle Application Server and
> Tomcat when run with the '-server' option.
> In all cases, the root cause is the same: the security policy for the
> container needs to include the Permissions needed to execute JSPWiki.
> However, full enumeration of the Permissions needed is complicated
> significantly by the fact that JSPWiki does not compartmentalized privileged
> calls the way it should. For example, any code in JSPWiki that accesses files
> should be enclosed by AccessController.doPrivileged() blocks.
> The result of our current approach (or rather, lack of privileged code
> compartmentalization) means that an effective policy cannot be written.
> This bug is to remind ARJ that he needs to work on this. He is currently
> writing some diagnostic tools that will make this process easier. However,
> it's going to take a while...
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
