This is the mail archive of the
java-patches@gcc.gnu.org
mailing list for the Java project.
Re: URLClassLoader update
Hi,
On Tue, 2002-11-26 at 01:47, Tom Tromey wrote:
> >>>>> "Mark" == Mark Wielaard <mark@klomp.org> writes:
>
> Mark> (URLClassLoader now works for remote locations! - now if only we
> Mark> had a complete verifier and security permissions framework...).
>
> What's missing from the verifier? Or are you referring to its known
> bugs? Or something else?
I was referring to its known bugs. At the moment I don't trust it to
catch all malformed byte code. We could really use someone who wants to
go over that piece of code and prove it correct.
> About security stuff, yes, that would be great. My impression is that
> the Classpath code has the required checks (are there places where it
> doesn't?). So we just need the runtime support (which Andrew has and
> which should go in pretty soon), an audit of unmerged classes, and an
> audit of gnu.* to ensure that implementation classes can't be used to
> circumvent security.
Andrew has the runtime support part, now that is cool!
We have most security checks in place, but a good audit of all the code
to make sure that it cannot be used to circumvent the security policy is
really needed (and costs a lot of time).
Cheers,
Mark