[JBoss-dev] classloading security in remoting

Tue, 13 Jan 2004 00:09:09 -0800

There has been concern with jboss remoting allowing remote classloading (server-side and client-side). I have turned this off by default and can be turned on via configuration of the remoting connectors. This is a short-term fix until a long term solution can be implemented to use the invocation target's classloader.

An example config with both server-side and client-side classloading enabled would look like:

     <mbean code="org.jboss.remoting.transport.Connector"
       xmbean-dd="org/jboss/remoting/transport/Connector.xml"
       name="jboss.remoting:service=Connector,transport=Socket"
       display-name="Socket transport Connector">

<attribute name="InvokerLocator">socket://localhost:8084</attribute>

<attribute name="Configuration">
<classloading>
<server-side>true</server-side>
<client-side>true</client-side>
</classloading>
<handlers>
<handler subsystem="JMX">org.jboss.mx.remoting.JMXSubsystemInvocationHandler</handler>
</handlers>
</attribute>

</mbean>







-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
JBoss-Development mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-development

Reply via email to