author | skoppar |
Fri, 24 Sep 2010 22:42:14 -0700 | |
changeset 7059 | 79caba0caf4f |
parent 5555 | b2b5ed3f0d0d |
permissions | -rw-r--r-- |
4 | 1 |
/* |
7059
79caba0caf4f
6891766: Vulnerabilities in use of reflection in CORBA
skoppar
parents:
5555
diff
changeset
|
2 |
* Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved. |
4 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5555 | 7 |
* published by the Free Software Foundation. Oracle designates this |
4 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5555 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
4 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5555 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
4 | 24 |
*/ |
25 |
package com.sun.corba.se.spi.orb ; |
|
26 |
||
27 |
import java.util.Map ; |
|
28 |
import java.util.Set ; |
|
29 |
import java.util.Iterator ; |
|
30 |
import java.util.Properties ; |
|
31 |
||
32 |
import java.security.PrivilegedExceptionAction ; |
|
33 |
import java.security.PrivilegedActionException ; |
|
34 |
import java.security.AccessController ; |
|
35 |
||
36 |
import java.lang.reflect.Field ; |
|
37 |
||
38 |
import org.omg.CORBA.INTERNAL ; |
|
39 |
||
40 |
import com.sun.corba.se.spi.logging.CORBALogDomains ; |
|
41 |
||
42 |
import com.sun.corba.se.impl.logging.ORBUtilSystemException ; |
|
43 |
||
44 |
import com.sun.corba.se.impl.orbutil.ObjectUtility ; |
|
45 |
||
46 |
// XXX This could probably be further extended by using more reflection and |
|
47 |
// a dynamic proxy that satisfies the interfaces that are inherited by the |
|
48 |
// more derived class. Do we want to go that far? |
|
49 |
public abstract class ParserImplBase { |
|
50 |
private ORBUtilSystemException wrapper ; |
|
51 |
||
52 |
protected abstract PropertyParser makeParser() ; |
|
53 |
||
54 |
/** Override this method if there is some needed initialization |
|
55 |
* that takes place after argument parsing. It is always called |
|
56 |
* at the end of setFields. |
|
57 |
*/ |
|
58 |
protected void complete() |
|
59 |
{ |
|
60 |
} |
|
61 |
||
62 |
public ParserImplBase() |
|
63 |
{ |
|
64 |
// Do nothing in this case: no parsing takes place |
|
65 |
wrapper = ORBUtilSystemException.get( |
|
66 |
CORBALogDomains.ORB_LIFECYCLE ) ; |
|
67 |
} |
|
68 |
||
69 |
public void init( DataCollector coll ) |
|
70 |
{ |
|
71 |
PropertyParser parser = makeParser() ; |
|
72 |
coll.setParser( parser ) ; |
|
73 |
Properties props = coll.getProperties() ; |
|
74 |
Map map = parser.parse( props ) ; |
|
75 |
setFields( map ) ; |
|
76 |
} |
|
77 |
||
78 |
private Field getAnyField( String name ) |
|
79 |
{ |
|
80 |
Field result = null ; |
|
81 |
||
82 |
try { |
|
83 |
Class cls = this.getClass() ; |
|
84 |
result = cls.getDeclaredField( name ) ; |
|
85 |
while (result == null) { |
|
86 |
cls = cls.getSuperclass() ; |
|
87 |
if (cls == null) |
|
88 |
break ; |
|
89 |
||
90 |
result = cls.getDeclaredField( name ) ; |
|
91 |
} |
|
92 |
} catch (Exception exc) { |
|
93 |
throw wrapper.fieldNotFound( exc, name ) ; |
|
94 |
} |
|
95 |
||
96 |
if (result == null) |
|
97 |
throw wrapper.fieldNotFound( name ) ; |
|
98 |
||
99 |
return result ; |
|
100 |
} |
|
101 |
||
102 |
protected void setFields( Map map ) |
|
103 |
{ |
|
104 |
Set entries = map.entrySet() ; |
|
105 |
Iterator iter = entries.iterator() ; |
|
106 |
while (iter.hasNext()) { |
|
107 |
java.util.Map.Entry entry = (java.util.Map.Entry)(iter.next()) ; |
|
108 |
final String name = (String)(entry.getKey()) ; |
|
109 |
final Object value = entry.getValue() ; |
|
110 |
||
111 |
try { |
|
112 |
AccessController.doPrivileged( |
|
113 |
new PrivilegedExceptionAction() { |
|
114 |
public Object run() throws IllegalAccessException, |
|
115 |
IllegalArgumentException |
|
116 |
{ |
|
117 |
Field field = getAnyField( name ) ; |
|
118 |
field.setAccessible( true ) ; |
|
119 |
field.set( ParserImplBase.this, value ) ; |
|
120 |
return null ; |
|
121 |
} |
|
122 |
} |
|
123 |
) ; |
|
124 |
} catch (PrivilegedActionException exc) { |
|
125 |
// Since exc wraps the actual exception, use exc.getCause() |
|
126 |
// instead of exc. |
|
127 |
throw wrapper.errorSettingField( exc.getCause(), name, |
|
7059
79caba0caf4f
6891766: Vulnerabilities in use of reflection in CORBA
skoppar
parents:
5555
diff
changeset
|
128 |
value.toString() ) ; |
4 | 129 |
} |
130 |
} |
|
131 |
||
132 |
// Make sure that any extra initialization takes place after all the |
|
133 |
// fields are set from the map. |
|
134 |
complete() ; |
|
135 |
} |
|
136 |
} |