users@jersey.java.net

Re: [Jersey] Using Jersey with Security Manager

From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Tue, 03 Jun 2008 16:58:48 +0200

Michael Elman wrote:
> Hi,
>
> I have recently started using Jersey and I ran into strange problems
> when executing the Jersey's code on application server that has a
> SecurityManager.
> The problems happen, since the Jersey's code tries to access private
> class fields and a SecurityManager prohibits it.
>
> Did anyone experienced similar problems?
>

Could you provide more details, on the exact error (e.g. stack traces
and Jersey version).

I recently made changes to the injection code, but i tried to make sure
it behaves the same. Namely it attempts to modify the accessibility of a
field:

   private void configureField(final Field f) {
       if (!f.isAccessible()) {
           AccessController.doPrivileged(new PrivilegedAction<Object>() {
               public Object run() {
                   f.setAccessible(true);
                   return null;
               }
           });
       }
   }

so injection can be performed.

My guess is the security manager has disabled the reflect permission
target "suppressAccessChecks".

I wonder if it would be resolved if the jersey.jar was associated with
the application server rather than with the application?

Paul.

> Thanks,
> Michael.
>
> http://tarlogonjava.blogspot.com/

-- 
| ? + ? = To question
----------------\
    Paul Sandoz
         x38109
+33-4-76188109