This commit is contained in:
Lana Steuck 2015-01-24 23:24:13 -08:00
commit 9138e3128e
12 changed files with 164 additions and 154 deletions

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -205,7 +205,15 @@ public abstract class RuntimeBuiltinLeafInfoImpl<T> extends BuiltinLeafInfoImpl<
static {
QName[] qnames = (System.getProperty(MAP_ANYURI_TO_URI) == null) ? new QName[] {
String MAP_ANYURI_TO_URI_VALUE = AccessController.doPrivileged(
new PrivilegedAction<String>() {
@Override
public String run() {
return System.getProperty(MAP_ANYURI_TO_URI);
}
}
);
QName[] qnames = (MAP_ANYURI_TO_URI_VALUE == null) ? new QName[] {
createXS("string"),
createXS("anySimpleType"),
createXS("normalizedString"),
@ -318,7 +326,7 @@ public abstract class RuntimeBuiltinLeafInfoImpl<T> extends BuiltinLeafInfoImpl<
return v.toExternalForm();
}
});
if (System.getProperty(MAP_ANYURI_TO_URI) == null) {
if (MAP_ANYURI_TO_URI_VALUE == null) {
secondaryList.add(
new StringImpl<URI>(URI.class, createXS("string")) {
public URI parse(CharSequence text) throws SAXException {
@ -782,17 +790,18 @@ public abstract class RuntimeBuiltinLeafInfoImpl<T> extends BuiltinLeafInfoImpl<
}
});
primaryList.add(
new StringImpl<BigDecimal>(BigDecimal.class,
createXS("decimal")
new StringImpl<BigDecimal>(BigDecimal.class,
createXS("decimal")
) {
public BigDecimal parse(CharSequence text) {
return DatatypeConverterImpl._parseDecimal(text.toString());
}
public BigDecimal parse(CharSequence text) {
return DatatypeConverterImpl._parseDecimal(text.toString());
}
public String print(BigDecimal v) {
return DatatypeConverterImpl._printDecimal(v);
public String print(BigDecimal v) {
return DatatypeConverterImpl._printDecimal(v);
}
}
});
);
primaryList.add(
new StringImpl<QName>(QName.class,
createXS("QName")
@ -820,7 +829,7 @@ public abstract class RuntimeBuiltinLeafInfoImpl<T> extends BuiltinLeafInfoImpl<
w.getNamespaceContext().declareNamespace(v.getNamespaceURI(),v.getPrefix(),false);
}
});
if (System.getProperty(MAP_ANYURI_TO_URI) != null) {
if (MAP_ANYURI_TO_URI_VALUE != null) {
primaryList.add(
new StringImpl<URI>(URI.class, createXS("anyURI")) {
public URI parse(CharSequence text) throws SAXException {
@ -838,16 +847,17 @@ public abstract class RuntimeBuiltinLeafInfoImpl<T> extends BuiltinLeafInfoImpl<
});
}
primaryList.add(
new StringImpl<Duration>(Duration.class, createXS("duration")) {
public String print(Duration duration) {
return duration.toString();
}
new StringImpl<Duration>(Duration.class, createXS("duration")) {
public String print(Duration duration) {
return duration.toString();
}
public Duration parse(CharSequence lexical) {
TODO.checkSpec("JSR222 Issue #42");
return DatatypeConverterImpl.getDatatypeFactory().newDuration(lexical.toString());
public Duration parse(CharSequence lexical) {
TODO.checkSpec("JSR222 Issue #42");
return DatatypeConverterImpl.getDatatypeFactory().newDuration(lexical.toString());
}
}
});
);
primaryList.add(
new StringImpl<Void>(Void.class) {
// 'void' binding isn't defined by the spec, but when the JAX-RPC processes user-defined

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2013, 2014 Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -25,8 +25,10 @@
package com.sun.xml.internal.bind.v2.util;
import com.sun.xml.internal.bind.Util;
import com.sun.xml.internal.bind.v2.Messages;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.xml.XMLConstants;
@ -43,8 +45,6 @@ import org.xml.sax.SAXException;
import org.xml.sax.SAXNotRecognizedException;
import org.xml.sax.SAXNotSupportedException;
import static com.sun.xml.internal.bind.Util.getSystemProperty;
/**
* Provides helper methods for creating properly configured XML parser
* factory instances with namespace support turned on and configured for
@ -68,7 +68,14 @@ public class XmlFactory {
*/
private static final String DISABLE_XML_SECURITY = "com.sun.xml.internal.bind.disableXmlSecurity";
public static final boolean XML_SECURITY_DISABLED = Boolean.parseBoolean(getSystemProperty(DISABLE_XML_SECURITY));
private static final boolean XML_SECURITY_DISABLED = AccessController.doPrivileged(
new PrivilegedAction<Boolean>() {
@Override
public Boolean run() {
return Boolean.getBoolean(DISABLE_XML_SECURITY);
}
}
);
private static boolean isXMLSecurityDisabled(boolean runtimeSetting) {
return XML_SECURITY_DISABLED || runtimeSetting;

View File

@ -54,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -72,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -147,19 +147,12 @@ public class ProviderImpl extends Provider {
}
public EndpointReference readEndpointReference(final Source eprInfoset) {
// EPR constructors are private, so we need privilege escalation.
// this unmarshalling can only access instances of a fixed, known set of classes,
// so doing that shouldn't introduce security vulnerability.
return AccessController.doPrivileged(new PrivilegedAction<EndpointReference>() {
public EndpointReference run() {
try {
Unmarshaller unmarshaller = eprjc.get().createUnmarshaller();
return (EndpointReference) unmarshaller.unmarshal(eprInfoset);
} catch (JAXBException e) {
throw new WebServiceException("Error creating Marshaller or marshalling.", e);
}
}
});
try {
Unmarshaller unmarshaller = eprjc.get().createUnmarshaller();
return (EndpointReference) unmarshaller.unmarshal(eprInfoset);
} catch (JAXBException e) {
throw new WebServiceException("Error creating Marshaller or marshalling.", e);
}
}
public <T> T getPort(EndpointReference endpointReference, Class<T> clazz, WebServiceFeature... webServiceFeatures) {

View File

@ -54,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -72,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);

View File

@ -63,6 +63,8 @@ import java.io.InputStream;
import java.io.OutputStreamWriter;
import java.io.Writer;
import java.net.URL;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;
@ -84,12 +86,16 @@ public class XmlUtil {
private static final Logger LOGGER = Logger.getLogger(XmlUtil.class.getName());
private static boolean XML_SECURITY_DISABLED;
private static final String DISABLE_XML_SECURITY = "com.sun.xml.internal.ws.disableXmlSecurity";
static {
String disableXmlSecurity = System.getProperty("com.sun.xml.internal.ws.disableXmlSecurity");
XML_SECURITY_DISABLED = disableXmlSecurity == null || !Boolean.valueOf(disableXmlSecurity);
}
private static boolean XML_SECURITY_DISABLED = AccessController.doPrivileged(
new PrivilegedAction<Boolean>() {
@Override
public Boolean run() {
return Boolean.getBoolean(DISABLE_XML_SECURITY);
}
}
);
public static String getPrefix(String s) {
int i = s.indexOf(':');

View File

@ -38,6 +38,9 @@ import java.util.logging.Logger;
/**
* Utils class.
*
* WARNING: If you are doing any changes don't forget to change other Utils classes in different packages.
*
* Has *package private* access to avoid inappropriate usage.
*/
final class Utils {
@ -51,17 +54,20 @@ final class Utils {
static { // we statically initializing REFLECTION_NAVIGATOR property
try {
Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
//noinspection unchecked
final Method getInstance = refNav.getDeclaredMethod("getInstance");
final Class refNav = Class.forName("com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator");
// requires accessClassInPackage privilege
AccessController.doPrivileged(
new PrivilegedAction<Object>() {
final Method getInstance = AccessController.doPrivileged(
new PrivilegedAction<Method>() {
@Override
public Object run() {
getInstance.setAccessible(true);
return null;
public Method run() {
try {
Method getInstance = refNav.getDeclaredMethod("getInstance");
getInstance.setAccessible(true);
return getInstance;
} catch (NoSuchMethodException e) {
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
}
}
}
);
@ -69,16 +75,10 @@ final class Utils {
//noinspection unchecked
REFLECTION_NAVIGATOR = (Navigator<Type, Class, Field, Method>) getInstance.invoke(null);
} catch (ClassNotFoundException e) {
e.printStackTrace();
throw new IllegalStateException("Can't find ReflectionNavigator class");
} catch (InvocationTargetException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance throws the exception");
} catch (NoSuchMethodException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance can't be found");
} catch (IllegalAccessException e) {
e.printStackTrace();
throw new IllegalStateException("ReflectionNavigator.getInstance method is inaccessible");
} catch (SecurityException e) {
LOGGER.log(Level.FINE, "Unable to access ReflectionNavigator.getInstance", e);