Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-02 01:48:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix problem:

Browse Source 
Subject:
        Recent rhino broke security support
   Date:
        Tue, 23 Jan 2001 08:07:45 -0500
   From:
        "Kurt Westerfeld" <kurt@managedobjects.com>
     To:
        "Norris Boyd" <nboyd@atg.com>


Norris.....I like the changes made to FunctionObject to do method invocation
much faster.  Very slick.

Problem tho: this mechanism does not veer into the security support plugin
on context for defining a class.  This is crucial do creating event adapter
code later in applet environments.

I'm going to look into this, but perhaps you could probably make the changes
faster than I.

Unfortunately for us, we found this problem yesterday at a customer site.
:-(  Shame on us.

________________________________________________________________________
  Kurt Westerfeld
  Senior Software Architect
  Managed Objects
  mailto:kwester@ManagedObjects.com
  703.770.7225
  http://www.ManagedObjects.com

  Managed Objects: manage technology > rule business
This commit is contained in:
nboyd%atg.com 2001-01-23 17:48:41 +00:00
parent bf882c78fb
commit 1a357f5fda
2 changed files with 34 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
js/rhino/org/mozilla/javascript/FunctionObject.java
View File

@ -793,9 +793,23 @@ public class FunctionObject extends NativeFunction {
try {
byte[] bytes = bos.toByteArray();
classLoader.defineClass(className, bytes);
Class clazz = classLoader.loadClass(className, true);
result = (Invoker)clazz.newInstance();
Context cx = Context.getCurrentContext();
SecuritySupport ss = cx == null ? null : cx.getSecuritySupport();
Class c;
if (ss != null) {
// This will be compiled using the security domain of the
// first class making a call. Then the result will be cached
// and used by subsequent calls (which may not necessarily
// be from the same security domain). Since Rhino generates
// the code, this shouldn't be a security hole.
Object securityDomain = cx.getSecurityDomainForStackDepth(-1);
c = ss.defineClass(className, bytes, securityDomain);
} else {
classLoader.defineClass(className, bytes);
c = classLoader.loadClass(className, true);
}
result = (Invoker)c.newInstance();
if (false) {
System.out.println("Generated method delegate for: " + method.getName()

20
js/rhino/src/org/mozilla/javascript/FunctionObject.java
View File

@ -793,9 +793,23 @@ public class FunctionObject extends NativeFunction {
try {
byte[] bytes = bos.toByteArray();
classLoader.defineClass(className, bytes);
Class clazz = classLoader.loadClass(className, true);
result = (Invoker)clazz.newInstance();
Context cx = Context.getCurrentContext();
SecuritySupport ss = cx == null ? null : cx.getSecuritySupport();
Class c;
if (ss != null) {
// This will be compiled using the security domain of the
// first class making a call. Then the result will be cached
// and used by subsequent calls (which may not necessarily
// be from the same security domain). Since Rhino generates
// the code, this shouldn't be a security hole.
Object securityDomain = cx.getSecurityDomainForStackDepth(-1);
c = ss.defineClass(className, bytes, securityDomain);
} else {
classLoader.defineClass(className, bytes);
c = classLoader.loadClass(className, true);
}
result = (Invoker)c.newInstance();
if (false) {
System.out.println("Generated method delegate for: " + method.getName()