users@glassfish.java.net

Re: Security wrt runtime permissions and createClassLoader

From: Kumar Jayanti <Vbkumar.Jayanti_at_Sun.COM>
Date: Mon, 25 May 2009 15:49:16 +0530

Hi Paul,

    Sorry for the late reply.
    Are you running on V3 or V2. Can you send us the full stack trace.

Thanks.
kumar

Paul G. Szabady wrote:
> Greetings,
>
> One of our developers is trying to run a jasper report through his app to generate a pdf and gets the following error.
>
> java.security.AccessControlException: access denied (java.lang.RuntimePermission createClassLoader)
>
> Is there a safe way to allow him to the access he would need to load the class(es) that jasper wants?
>
> After a bit of research, I must say I'm a bit concerned.
>
> From Sun's website
> (http://java.sun.com/developer/onlineTraining/Programming/JDCBook/appA.html#RuntimePermission):
>
> createClassLoader: This target grants permission to create a class
> loader. Granting this permission might allow a malicious application to
> instantiate its own class loader and load harmful classes into the
> system. Once loaded, the class loader could place these classes into any
> protection domain and give them full permissions for that domain.
>
> Thoughts / suggestions?
>
>