From bsf-userdanielmartin@example.com Sat Mar 03 10:44:12 2007
Return-Path: <bsf-userdanielmartin@example.com>
Delivered-To: danielmartin@example.com
Received: (qmail 66607 invoked from network); 3 Mar 2007 10:44:12 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 3 Mar 2007 10:44:12 -0000
Received: (qmail 34545 invoked by uid 500); 3 Mar 2007 10:44:20 -0000
Delivered-To: danielmartin@example.com
Received: (qmail 34519 invoked by uid 500); 3 Mar 2007 10:44:20 -0000
Mailing-List: contact danielmartin@example.com; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:danielmartin@example.com>
List-Help: <mailto:danielmartin@example.com>
List-Post: <mailto:danielmartin@example.com>
List-Id: "Bean Scripting Framework users" <bsf-user.jakarta.apache.org>
Reply-To: "Bean Scripting Framework users" <danielmartin@example.com>
Delivered-To: mailing list danielmartin@example.com
Received: (qmail 34508 invoked by uid 99); 3 Mar 2007 10:44:20 -0000
Received: from herse.apache.org (HELO herse.apache.org) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 03 Mar 2007 02:44:20 -0800
X-ASF-Spam-Status: No, hits=2.0 required=10.0
	tests=HTML_MESSAGE,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (herse.apache.org: domain of danielmartin@example.com designates 83.161.120.155 as permitted sender)
Received: from [83.161.120.155] (HELO mtagate2.uk.ibm.com) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 03 Mar 2007 02:44:06 -0800
Received: from d06nrmr1407.portsmouth.uk.ibm.com (d06nrmr1407.portsmouth.uk.ibm.com [83.161.120.155])
	by mtagate2.uk.ibm.com (8.13.8/8.13.8) with ESMTP id l23AhiaL088180
	for <danielmartin@example.com>; Sat, 3 Mar 2007 10:43:44 GMT
Received: from d06av02.portsmouth.uk.ibm.com (d06av02.portsmouth.uk.ibm.com [83.161.120.155])
	by d06nrmr1407.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v8.3) with ESMTP id l23AhgPI1400888
	for <danielmartin@example.com>; Sat, 3 Mar 2007 10:43:44 GMT
Received: from d06av02.portsmouth.uk.ibm.com (loopback [83.161.120.155])
	by d06av02.portsmouth.uk.ibm.com (83.161.120.15560308/8.13.3) with ESMTP id l23AhgaX030634
	for <danielmartin@example.com>; Sat, 3 Mar 2007 10:43:42 GMT
Received: from d06ml068.portsmouth.uk.ibm.com (d06ml068.portsmouth.uk.ibm.com [83.161.120.155])
	by d06av02.portsmouth.uk.ibm.com (83.161.120.15560308/8.12.11) with ESMTP id l23AhgxF030629
	for <danielmartin@example.com>; Sat, 3 Mar 2007 10:43:42 GMT
In-Reply-To: <danielmartin@example.com>
X-Disclaimed: 36570
Importance: Normal
MIME-Version: 1.0
To: "Bean Scripting Framework users" <danielmartin@example.com>
Subject: Re: BSF with Rhino, Java 2 Security problem
X-Mailer: Lotus Notes Release 7.0 HF277 June 21, 2006
Message-ID: <danielmartin@example.com>
From: Anthony Elder <danielmartin@example.com>
Date: Sat, 3 Mar 2007 10:43:43 +0000
X-MIMETrack: Serialize by Router on D06ML068/06/M/IBM(Release 7.0.2HF71 | November 3, 2006) at
 03/03/2007 10:43:42,
	Serialize complete at 03/03/2007 10:43:42
Content-Type: multipart/alternative; boundary="=_alternative 003AF0AE80257293_="
X-Virus-Checked: Checked by ClamAV on apache.org

--=_alternative 003AF0AE80257293_=
Content-Type: text/plain; charset="US-ASCII"

Maybe you should try asking over on the Rhino mailing list as this looks 
more like something they could help with than a BSF problem. 

See http://groups.google.co.uk/group/mozilla.dev.tech.js-engine/topics

       ...ant


Please respond to "Bean Scripting Framework users" 
<danielmartin@example.com> 
To:     danielmartin@example.com
cc:      
Subject:        BSF with Rhino, Java 2 Security problem



I have made extensive use of BSF with Rhino over the past several years to
code business logic in a Servlet based application in WebSphere v4. 
(upwards
of 100,000 loc in javascript) Moving to Websphere v5 and Java 1.4 with 
Java
2 Security has resulted in the exception below. 

BSF v2.4
Rhino v1.6.4

org.apache.bsf.BSFException: JavaScript Error:
java.lang.IllegalAccessException: Class org.mozilla.javascript.MemberBox 
can
not access a member of class java.util.TreeMap$KeyIterator with modifiers
"public"
                 at
org.apache.bsf.engines.javascript.JavaScriptEngine.handleError(JavaScriptEngine.java:195)
                 at
org.apache.bsf.engines.javascript.JavaScriptEngine.eval(JavaScriptEngine.java:147)
                 at 
org.apache.bsf.util.BSFEngineImpl.exec(BSFEngineImpl.java:141)
                 at org.apache.bsf.BSFManager$6.run(BSFManager.java:493)
                 at java.security.AccessController.doPrivileged1(Native 
Method)
                 at
java.security.AccessController.doPrivileged(AccessController.java(Compiled
Code))
                 at 
org.apache.bsf.BSFManager.exec(BSFManager.java(Compiled Code))
                 at
tools.JavaScriptEngineWrapper.jsExec(JavaScriptEngineWrapper.java(Inlined
Compiled Code))


For stack trace above: 
  Package tools is the app
  jsExec calls BSF to execute a javascript 
  the javascript starts to run in   JavaScriptEngine.eval
  this particular script creates a TreeMap object and then uses an 
iterator
over its contents, which results in the
  IllegalAccessException

Here's the policy file 

grant codeBase "file:${application}" {
  permission java.security.AllPermission;
};

grant codeBase "file:${jars}" {
  permission java.security.AllPermission;
};

grant codeBase "file:${connectorComponent}" {
  permission java.security.AllPermission;
};

grant codeBase "file:${webComponent}" {
  permission java.security.AllPermission;
};

grant codeBase "file:${ejbComponent}" {
  permission java.security.AllPermission;
};

grant {
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
  permission java.lang.RuntimePermission "accessDeclaredMembers";
};

The JavaScript which results in the exception (but many other various
examples also fail)

   var map = new java.util.TreeMap();
   // put data in map
   var it = map.keySet().iterator();


I stress that this code works as designed with Java 2 Security disabled.


Can anyone suggest a policy file change to allow code like this to work? I
can supply additional documentation upon request. 

Thank you!

-- 
View this message in context: 
http://www.nabble.com/BSF-with-Rhino%2C-Java-2-Security-problem-tf3306796.html#a9198064

Sent from the BSF - User mailing list danielmartin@example.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: danielmartin@example.com
For additional commands, e-mail: danielmartin@example.com








Unless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number 
741598. 
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU






--=_alternative 003AF0AE80257293_=--

From bsf-userdanielmartin@example.com Sun Mar 04 02:27:30 2007
Return-Path: <bsf-userdanielmartin@example.com>
Delivered-To: danielmartin@example.com
Received: (qmail 10257 invoked from network); 4 Mar 2007 02:27:30 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 4 Mar 2007 02:27:30 -0000
Received: (qmail 13690 invoked by uid 500); 4 Mar 2007 02:27:39 -0000
Delivered-To: danielmartin@example.com
Received: (qmail 13672 invoked by uid 500); 4 Mar 2007 02:27:38 -0000
Mailing-List: contact danielmartin@example.com; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:danielmartin@example.com>
List-Help: <mailto:danielmartin@example.com>
List-Post: <mailto:danielmartin@example.com>
List-Id: "Bean Scripting Framework users" <bsf-user.jakarta.apache.org>
Reply-To: "Bean Scripting Framework users" <danielmartin@example.com>
Delivered-To: mailing list danielmartin@example.com
Received: (qmail 13661 invoked by uid 99); 4 Mar 2007 02:27:38 -0000
Received: from herse.apache.org (HELO herse.apache.org) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 03 Mar 2007 18:27:38 -0800
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_HELO_PASS,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (herse.apache.org: domain of danielmartin@example.com designates 83.161.120.155 as permitted sender)
Received: from [83.161.120.155] (HELO talk.nabble.com) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 03 Mar 2007 18:27:28 -0800
Received: from [83.161.120.155] (helo=jubjub.nabble.com)
	by talk.nabble.com with esmtp (Exim 4.50)
	id 1HNgRH-0003GP-KS
	for danielmartin@example.com; Sat, 03 Mar 2007 18:27:07 -0800
Message-ID: <danielmartin@example.com>
Date: Sat, 3 Mar 2007 18:27:07 -0800 (PST)
From: Mike Blan <danielmartin@example.com>
To: danielmartin@example.com
Subject: Re: BSF with Rhino, Java 2 Security problem
In-Reply-To: <danielmartin@example.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Nabble-From: danielmartin@example.com
References: <danielmartin@example.com>
X-Virus-Checked: Checked by ClamAV on apache.org


I will post this in case anyone else runs into same. This worked for my
application.

See   https://bugzilla.mozilla.org/show_bug.cgi?id=3D190841#c3 bugzilla=20

In   cookxml.cookjs.util.ProxyHandler.invoke(...)

=09=09=09// return JavaAdapter.callMethod (m_delegate, function, args,
convertionMask);
=09=09=09// JavaAdapter.callMethod in Rhino 1.6.4 requires at least a null =
factory
reference.
=09=09=09ContextFactory factory =3D null;
=09=09=09return JavaAdapter.callMethod(factory, m_delegate, function, args,
convertionMask);

In  org.apache.bsf.engines.javascript.JavaScriptEngine.call(...)  and
eval(...)=20

            cx.setOptimizationLevel(-1);
            cx.setGeneratingDebug(false);
            cx.setGeneratingSource(false);
            //cx.setOptimizationLevel(0);=20
            cx.setDebugger(null, null);
            // Mozilla Bug 190841 =E2=80=93 Generated classes have too low
privileges=20
            ProxyJavaAdapter.init (cx, global, true);
           =20
            retval =3D
                ((Function) fun).call(cx, global, global, args);



--=20
View this message in context: http://www.nabble.com/BSF-with-Rhino%2C-Java-=
2-Security-problem-tf3306796.html#a9292215
Sent from the BSF - User mailing list danielmartin@example.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: danielmartin@example.com
For additional commands, e-mail: danielmartin@example.com


From bsf-userdanielmartin@example.com Mon Mar 05 13:41:03 2007
Return-Path: <bsf-userdanielmartin@example.com>
Delivered-To: danielmartin@example.com
Received: (qmail 12398 invoked from network); 5 Mar 2007 13:41:03 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 5 Mar 2007 13:41:03 -0000
Received: (qmail 39826 invoked by uid 500); 5 Mar 2007 13:41:12 -0000
Delivered-To: danielmartin@example.com
Received: (qmail 39761 invoked by uid 500); 5 Mar 2007 13:41:11 -0000
Mailing-List: contact danielmartin@example.com; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:danielmartin@example.com>
List-Help: <mailto:danielmartin@example.com>
List-Post: <mailto:danielmartin@example.com>
List-Id: "Bean Scripting Framework users" <bsf-user.jakarta.apache.org>
Reply-To: "Bean Scripting Framework users" <danielmartin@example.com>
Delivered-To: mailing list danielmartin@example.com
Received: (qmail 39750 invoked by uid 99); 5 Mar 2007 13:41:11 -0000
Received: from herse.apache.org (HELO herse.apache.org) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 05 Mar 2007 05:41:11 -0800
X-ASF-Spam-Status: No, hits=0.0 required=10.0
	tests=
X-Spam-Check-By: apache.org
Received-SPF: pass (herse.apache.org: local policy)
Received: from [83.161.120.155] (HELO sslmail1.wu-wien.ac.at) (83.161.120.155)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 05 Mar 2007 05:40:59 -0800
Received: from [83.161.120.155] (abt-wi-020.wu-wien.ac.at [83.161.120.155])
	(authenticated bits=0)
	by sslmail1.wu-wien.ac.at (8.13.6/8.13.6) with ESMTP id l25DeYnq077363
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
	for <danielmartin@example.com>; Mon, 5 Mar 2007 14:40:36 +0100 (CET)
	(envelope-from danielmartin@example.com)
Message-ID: <danielmartin@example.com>
Date: Mon, 05 Mar 2007 14:40:34 +0100
From: "Rony G. Flatscher" <danielmartin@example.com>
User-Agent: Thunderbird 83.161.120.155 (Windows/20070221)
MIME-Version: 1.0
To: Bean Scripting Framework users <danielmartin@example.com>
Subject: Re: BSF with Rhino, Java 2 Security problem
References: <danielmartin@example.com> <danielmartin@example.com>
In-Reply-To: <danielmartin@example.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Virus-Checked: Checked by ClamAV on apache.org

Hi Mike,

Mike Blan wrote:
> I will post this in case anyone else runs into same. This worked for my
> application.
>
> See   https://bugzilla.mozilla.org/show_bug.cgi?id=190841#c3 bugzilla 
>
> In   cookxml.cookjs.util.ProxyHandler.invoke(...)
>
> 			// return JavaAdapter.callMethod (m_delegate, function, args,
> convertionMask);
> 			// JavaAdapter.callMethod in Rhino 1.6.4 requires at least a null factory
> reference.
> 			ContextFactory factory = null;
> 			return JavaAdapter.callMethod(factory, m_delegate, function, args,
> convertionMask);
>
> In  org.apache.bsf.engines.javascript.JavaScriptEngine.call(...)  and
> eval(...) 
>
>             cx.setOptimizationLevel(-1);
>             cx.setGeneratingDebug(false);
>             cx.setGeneratingSource(false);
>             //cx.setOptimizationLevel(0); 
>             cx.setDebugger(null, null);
>             // Mozilla Bug 190841 – Generated classes have too low
> privileges 
>             ProxyJavaAdapter.init (cx, global, true);
>             
>             retval =
>                 ((Function) fun).call(cx, global, global, args);
>   
Could you be so kind and supply a patch under the Apache license?
[AFAICS the ProxyJavaAdapter.init() needs to be invoked from the
BSF-Javascript/Rhino engine?]


Regards,

---rony


---------------------------------------------------------------------
To unsubscribe, e-mail: danielmartin@example.com
For additional commands, e-mail: danielmartin@example.com



{'source': 'Apache Software Foundation Public Mail Archives'}