On Apr 14, 2009, at 6:49 PM, Tatu Saloranta wrote:
> On Tue, Apr 14, 2009 at 9:40 AM, Paul Sandoz <Paul.Sandoz_at_sun.com>
> wrote:
>>
>> On Apr 14, 2009, at 6:34 PM, Tatu Saloranta wrote:
> ...
>>>> XMLBeans? JiBX?
>>>
>>> Most data binding frameworks will probably have issues, due to
>>> security limitations or missing classes. It's not so much the
>>> security
>>> manager policies (which I understand -- and accept as a price of
>>> otherwise really neat option for deployment) but rather missing
>>> classes, and related problems that get you.
>>>
>>
>> +1 Well put.
>
> One observation/question regarding the white list: Stax API seems to
> be missing. If so, wouldn't this meant that you could not use Stax
> parsers on anything -- since API classes are not whitelisted, trying
> to add api jar and load classes should fail?
>
I would presume so. You might be able to add a renamed stax jar/impl
to the war. It would be an interesting experiment to see if that would
work with a modified Woodstox.
> If this is the case, it'd be another indication that what you get is
> not really 1.6, but some arbitrary subset, perhaps just based on which
> packages developers doing it happened to be aware of.
>
It could be. Hard to fathom really without some details from the GAE
developers themselves.
Paul.