fabiobrz opened a new pull request, #744:
URL: https://github.com/apache/ws-wss4j/pull/744
Summary
- Loader.loadInputStream() accesses the filesystem via Files.exists() and
Files.newInputStream() without privileged blocks, causing
AccessControlException in security-manager-enabled environments (e.g. JBoss EAP
8.1 with -secmgr)
- Wraps both calls in AccessController.doPrivileged(), consistent with the
existing pattern used by getTCL() and getClassLoader() in the same class
Test plan
- Reproduced the exact CI failure against JBoss EAP 8.1.9.GA-CR3 with WSS4J
3.0.6 overlaid and security manager enabled:
- WSTrustTestCase#testActAs → AccessControlException: FilePermission
"actasstore.jks" "read"
- WSTrustTestCase#testOnBehalfOf → AccessControlException: FilePermission
"..." "read"
- Validated the fix by overlaying WSS4J 3.0.7-SNAPSHOT with the
doPrivileged() change:
- Both tests pass with security manager enabled
- WSS4J ws-security-common unit tests pass (4155 tests, 0 failures)
Fixes: https://issues.apache.org/jira/browse/WSS-733
---
AI-Disclosure: Research, log analysis, and root cause identification were
led and driven by human input and guidance. AI findings were critically
reviewed and manually verified. The resulting code changes have been
human-reviewed, tested, and validated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
