[
https://issues.apache.org/jira/browse/OWB-1027?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14209420#comment-14209420
]
Mark Struberg commented on OWB-1027:
------------------------------------
imo the debug part is _not_ a blocker. We usually only do very simple things in
our secured methods. They are pretty much trivial and most times just calls to
reflection and similar low level stuff we mostly delegate 1:1 to the
Class/ClassLoader.
The way to go is to remove our SecurityService and just use a static helper
class instead with public methods. Those methods DO NOT have any
doPriviligedAccess block at all! So even if a user would invoke them manually
he could not do any harm.
Instead those public static methods will get 'inlined' as private static
methods by commons-privilizer (using ASM). During this inlining they will also
get wrapped in an AccessController block IF a SecurityManager is present
(otherwise the straight code gets used without any temp object creation - which
even Java8 is _still_ not able to skip).
I'm not 100% sure if we just delegate to the original static methods in case of
no SecurityManager or do inline those also (which I think we do). If we would
just delegate then you could even debug.
> Use Apache Commons Weaver's privilizer module for privileged action code in
> OWB
> -------------------------------------------------------------------------------
>
> Key: OWB-1027
> URL: https://issues.apache.org/jira/browse/OWB-1027
> Project: OpenWebBeans
> Issue Type: Task
> Affects Versions: 1.5.0
> Reporter: Matt Benson
>
> See
> [http://commons.apache.org/proper/commons-weaver/commons-weaver-modules-parent/commons-weaver-privilizer-parent/index.html];
> this code was intended for helping Apache JEE components use the
> {{SecurityManager}} in such a fashion as to make the invocation of privileged
> actions as transparent as possible.
> A concern is that to make full use of the privilizer module's potential,
> OWB's {{SecurityService}} notion would IMO best be removed entirely to
> minimize the surface area of publicly accessible code that makes privileged
> calls. Since this interface and its implementations, as well as the
> {{deprecated SecurityUtil}} class, are {{public}}, this constitutes a break
> in API compatibility and forces the community to think about if, when, and
> how to upgrade OWB to v2.x .
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
