FYI: Some security fixes from GNU Classpath

[Mark Wielaard <mark at klomp dot org>]

Hi,

Here are a couple of small fixlets from GNU Classpath.

2004-09-26  Casey Marshall <csm@gnu.org>

       * java/security/ProtectionDomain.java
       (<init>(CodeSource,PermissionCollection)): set `staticBinding' to
       `true'.

       * java/security/SecureClassLoader.java
       (defineClass): make protection domain dynamically bound.
       (getPermissions): call `getCurrentPolicy' to avoid permission
       check.

Committed,

Mark

Index: java/security/ProtectionDomain.java
===================================================================
RCS file: /cvs/gcc/gcc/libjava/java/security/ProtectionDomain.java,v
retrieving revision 1.6
diff -u -r1.6 ProtectionDomain.java
--- java/security/ProtectionDomain.java	9 Sep 2004 19:44:06 -0000	1.6
+++ java/security/ProtectionDomain.java	26 Sep 2004 14:44:49 -0000
@@ -83,7 +83,7 @@
    */
   public ProtectionDomain(CodeSource codesource, PermissionCollection permissions)
   {
-    this(codesource, permissions, null, null, false);
+    this(codesource, permissions, null, null, true);
   }
 
   /**
Index: java/security/SecureClassLoader.java
===================================================================
RCS file: /cvs/gcc/gcc/libjava/java/security/SecureClassLoader.java,v
retrieving revision 1.10
diff -u -r1.10 SecureClassLoader.java
--- java/security/SecureClassLoader.java	9 Jul 2004 15:43:01 -0000	1.10
+++ java/security/SecureClassLoader.java	26 Sep 2004 14:44:49 -0000
@@ -84,7 +84,7 @@
     if (cs != null)
       {
 	ProtectionDomain protectionDomain
-		= new ProtectionDomain(cs, getPermissions(cs));
+          = new ProtectionDomain(cs, getPermissions(cs), this, null);
 	return super.defineClass(name, b, off, len, protectionDomain);
       } 
     else
@@ -102,7 +102,7 @@
    */
   protected PermissionCollection getPermissions(CodeSource cs)
   {
-    Policy policy = Policy.getPolicy();
+    Policy policy = Policy.getCurrentPolicy();
     return policy.getPermissions(cs);
   }
 }

Attachment: signature.asc
Description: This is a digitally signed message part