This is the mail archive of the
java@gcc.gnu.org
mailing list for the Java project.
Re: JSP Servlet container / WEB server
- From: Tom Tromey <tromey at redhat dot com>
- To: gnustuff at thisiscool dot com
- Cc: Andrew Haley <aph at redhat dot com>, java at gcc dot gnu dot org, Lars Andersen <lars at rimfaxe dot com>
- Date: 21 Jul 2003 16:27:49 -0600
- Subject: Re: JSP Servlet container / WEB server
- References: <NHANK1VYXCOLRQDAZW62C9B0A5IDG.3f1a9105@p733>
- Reply-to: tromey at redhat dot com
>>>>> "Mohan" == Mohan Embar <gnustuff@thisiscool.com> writes:
>> This is true. The gcj libraries don't implement the Java security
>> sandbox.
Mohan> Do they not implement this at all?
There's some support, but it isn't complete. The current security
to-do list is:
* Add missing security checks (I checked in a patch yesterday that
added a lot of them, but there are still a couple missing)
* Implement AccessController (thanks to Mark for pointing this out)
* Implement StackOverflowError
* Fix remaining verifier bugs (I have an unfinished patch that leaks
memory...)
* Test, test, test
* Real security audit
If you want precompilation to be secure, add:
* Fix known bugs in gcj verifier
Tom