Sure.
Below is an exception I got running HelloWorldWebApp example using:
SDK: 1.5.14
Server: Tomcat 5.5.23 with default security settings (run "startup
-security")
Jersey: 0.7
javax.servlet.ServletException: Servlet.init() for servlet Jersey Web
Application threw exception
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870)
org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685)
java.lang.Thread.run(Thread.java:595)
*root cause*
java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessDeclaredMembers)
java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
java.security.AccessController.checkPermission(AccessController.java:427)
java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
java.lang.SecurityManager.checkMemberAccess(SecurityManager.java:1662)
java.lang.Class.checkMemberAccess(Class.java:2125)
java.lang.Class.getDeclaredMethods(Class.java:1762)
com.sun.ws.rest.impl.modelapi.annotation.IntrospectionModeller.logNonPublicMethods(IntrospectionModeller.java:421)
com.sun.ws.rest.impl.modelapi.annotation.IntrospectionModeller.createResource(IntrospectionModeller.java:100)
com.sun.ws.rest.impl.application.WebApplicationImpl.getAbstractResource(WebApplicationImpl.java:219)
com.sun.ws.rest.impl.application.WebApplicationImpl.processRootResources(WebApplicationImpl.java:458)
com.sun.ws.rest.impl.application.WebApplicationImpl.initiate(WebApplicationImpl.java:370)
com.sun.ws.rest.impl.application.WebApplicationImpl.initiate(WebApplicationImpl.java:318)
com.sun.ws.rest.spi.container.servlet.ServletContainer.initiate(ServletContainer.java:392)
com.sun.ws.rest.spi.container.servlet.ServletContainer.load(ServletContainer.java:306)
com.sun.ws.rest.spi.container.servlet.ServletContainer.init(ServletContainer.java:119)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
java.lang.reflect.Method.invoke(Method.java:585)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:244)
java.security.AccessController.doPrivileged(Native Method)
javax.security.auth.Subject.doAsPrivileged(Subject.java:517)
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:276)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:162)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:115)
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870)
org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685)
java.lang.Thread.run(Thread.java:595)
As you can see it fails on java.lang.Class.getDeclaredMethods().
If I run the injection code, it fails on f.setAccessible(true).
As I know it's possible to grant specific permissions to a class, package or
even jar or folder inside the war, so it's possible to solve this exception
by granting the permissions to "com.sun.ws.rest" package or to jersey.jar
Although, I'm wandering if I'm the only one who cares about the
SecurityManager?
Best regards,
Michael.
On Tue, Jun 3, 2008 at 5:58 PM, Paul Sandoz <Paul.Sandoz_at_sun.com> wrote:
> Michael Elman wrote:
>
>> Hi,
>>
>> I have recently started using Jersey and I ran into strange problems when
>> executing the Jersey's code on application server that has a
>> SecurityManager.
>> The problems happen, since the Jersey's code tries to access private class
>> fields and a SecurityManager prohibits it.
>>
>> Did anyone experienced similar problems?
>>
>>
> Could you provide more details, on the exact error (e.g. stack traces and
> Jersey version).
>
> I recently made changes to the injection code, but i tried to make sure it
> behaves the same. Namely it attempts to modify the accessibility of a field:
>
> private void configureField(final Field f) {
> if (!f.isAccessible()) {
> AccessController.doPrivileged(new PrivilegedAction<Object>() {
> public Object run() {
> f.setAccessible(true);
> return null;
> }
> });
> }
> }
>
> so injection can be performed.
>
> My guess is the security manager has disabled the reflect permission target
> "suppressAccessChecks".
>
> I wonder if it would be resolved if the jersey.jar was associated with the
> application server rather than with the application?
>
> Paul.
>
> Thanks,
>> Michael.
>>
>> http://tarlogonjava.blogspot.com/
>>
>
> --
> | ? + ? = To question
> ----------------\
> Paul Sandoz
> x38109
> +33-4-76188109
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe_at_jersey.dev.java.net
> For additional commands, e-mail: users-help_at_jersey.dev.java.net
>
>