1 /*
2 * Copyright (c) 1995, 2013, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
104 {
105 String value = System.getProperty(name);
106
107 if (value != null && value.equalsIgnoreCase("true"))
108 {
109 String pkg = name.substring(24);
110
111 // Cache restricted packages
112 restrictedPackages.add(pkg);
113 }
114 }
115 }
116 return null;
117 }
118 });
119 }
120
121 /**
122 * get the current (first) instance of an AppletClassLoader on the stack.
123 */
124 private AppletClassLoader currentAppletClassLoader()
125 {
126 // try currentClassLoader first
127 ClassLoader loader = currentClassLoader();
128
129 if ((loader == null) || (loader instanceof AppletClassLoader))
130 return (AppletClassLoader)loader;
131
132 // if that fails, get all the classes on the stack and check them.
133 Class<?>[] context = getClassContext();
134 for (int i = 0; i < context.length; i++) {
135 loader = context[i].getClassLoader();
136 if (loader instanceof AppletClassLoader)
137 return (AppletClassLoader)loader;
138 }
139
140 /*
141 * fix bug # 6433620 the logic here is : try to find URLClassLoader from
142 * class context, check its AccessControlContext to see if
143 * AppletClassLoader is in stack when it's created. for this kind of
291 // starts with similar beginning characters
292 //
293 if (pkgname.equals(pkg) || pkgname.startsWith(pkg + "."))
294 {
295 checkPermission(new java.lang.RuntimePermission
296 ("accessClassInPackage." + pkgname));
297 }
298 }
299 }
300
301 /**
302 * Tests if a client can get access to the AWT event queue.
303 * <p>
304 * This method calls <code>checkPermission</code> with the
305 * <code>AWTPermission("accessEventQueue")</code> permission.
306 *
307 * @since 1.1
308 * @exception SecurityException if the caller does not have
309 * permission to access the AWT event queue.
310 */
311 public void checkAwtEventQueueAccess() {
312 AppContext appContext = AppContext.getAppContext();
313 AppletClassLoader appletClassLoader = currentAppletClassLoader();
314
315 if (AppContext.isMainContext(appContext) && (appletClassLoader != null)) {
316 // If we're about to allow access to the main EventQueue,
317 // and anything untrusted is on the class context stack,
318 // disallow access.
319 super.checkPermission(AWTPermissions.CHECK_AWT_EVENTQUEUE_PERMISSION);
320 }
321 } // checkAwtEventQueueAccess()
322
323 /**
324 * Returns the thread group of the applet. We consult the classloader
325 * if there is one.
326 */
327 public ThreadGroup getThreadGroup() {
328 /* If any applet code is on the execution stack, we return
329 that applet's ThreadGroup. Otherwise, we use the default
330 behavior. */
|
1 /*
2 * Copyright (c) 1995, 2014, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
104 {
105 String value = System.getProperty(name);
106
107 if (value != null && value.equalsIgnoreCase("true"))
108 {
109 String pkg = name.substring(24);
110
111 // Cache restricted packages
112 restrictedPackages.add(pkg);
113 }
114 }
115 }
116 return null;
117 }
118 });
119 }
120
121 /**
122 * get the current (first) instance of an AppletClassLoader on the stack.
123 */
124 @SuppressWarnings("deprecation")
125 private AppletClassLoader currentAppletClassLoader()
126 {
127 // try currentClassLoader first
128 ClassLoader loader = currentClassLoader();
129
130 if ((loader == null) || (loader instanceof AppletClassLoader))
131 return (AppletClassLoader)loader;
132
133 // if that fails, get all the classes on the stack and check them.
134 Class<?>[] context = getClassContext();
135 for (int i = 0; i < context.length; i++) {
136 loader = context[i].getClassLoader();
137 if (loader instanceof AppletClassLoader)
138 return (AppletClassLoader)loader;
139 }
140
141 /*
142 * fix bug # 6433620 the logic here is : try to find URLClassLoader from
143 * class context, check its AccessControlContext to see if
144 * AppletClassLoader is in stack when it's created. for this kind of
292 // starts with similar beginning characters
293 //
294 if (pkgname.equals(pkg) || pkgname.startsWith(pkg + "."))
295 {
296 checkPermission(new java.lang.RuntimePermission
297 ("accessClassInPackage." + pkgname));
298 }
299 }
300 }
301
302 /**
303 * Tests if a client can get access to the AWT event queue.
304 * <p>
305 * This method calls <code>checkPermission</code> with the
306 * <code>AWTPermission("accessEventQueue")</code> permission.
307 *
308 * @since 1.1
309 * @exception SecurityException if the caller does not have
310 * permission to access the AWT event queue.
311 */
312 @SuppressWarnings("deprecation")
313 public void checkAwtEventQueueAccess() {
314 AppContext appContext = AppContext.getAppContext();
315 AppletClassLoader appletClassLoader = currentAppletClassLoader();
316
317 if (AppContext.isMainContext(appContext) && (appletClassLoader != null)) {
318 // If we're about to allow access to the main EventQueue,
319 // and anything untrusted is on the class context stack,
320 // disallow access.
321 super.checkPermission(AWTPermissions.CHECK_AWT_EVENTQUEUE_PERMISSION);
322 }
323 } // checkAwtEventQueueAccess()
324
325 /**
326 * Returns the thread group of the applet. We consult the classloader
327 * if there is one.
328 */
329 public ThreadGroup getThreadGroup() {
330 /* If any applet code is on the execution stack, we return
331 that applet's ThreadGroup. Otherwise, we use the default
332 behavior. */
|