1 /*

     2  * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package com.sun.script.javascript;

    27 

    28 import java.util.*;

    29 import sun.org.mozilla.javascript.internal.*;

    30 

    31 /**

    32  * This class prevents script access to certain sensitive classes.

    33  * Note that this class checks over and above SecurityManager. i.e., although

    34  * a SecurityManager would pass, class shutter may still prevent access.

    35  *

    36  * @author A. Sundararajan

    37  * @since 1.6

    38  */

    39 final class RhinoClassShutter implements ClassShutter {

    40     private static Map<String, Boolean> protectedClasses;

    41     private static RhinoClassShutter theInstance;

    42 

    43     private RhinoClassShutter() {

    44     }

    45 

    46     static synchronized ClassShutter getInstance() {

    47         if (theInstance == null) {

    48             theInstance = new RhinoClassShutter();

    49             protectedClasses = new HashMap<String, Boolean>();

    50 

    51             // For now, we just have AccessController. Allowing scripts

    52             // to this class will allow it to execute doPrivileged in

    53             // bootstrap context. We can add more classes for other reasons.

    54             protectedClasses.put("java.security.AccessController", Boolean.TRUE);

    55         }

    56         return theInstance;

    57     }

    58 

    59     public boolean visibleToScripts(String fullClassName) {

    60         // first do the security check.

    61         SecurityManager sm = System.getSecurityManager();

    62         if (sm != null) {

    63             int i = fullClassName.lastIndexOf(".");

    64             if (i != -1) {

    65                 try {

    66                     sm.checkPackageAccess(fullClassName.substring(0, i));

    67                 } catch (SecurityException se) {

    68                     return false;

    69                 }

    70             }

    71         }

    72         // now, check is it a protected class.

    73         return protectedClasses.get(fullClassName) == null;

    74     }

    75 }