fix AccessControlException from SecurityManager in ClasspathOrder#594
Conversation
In ClasspathOrder, class path elements are converted to URLs by pathElementURL = new File(pathElementToStr).toURI().toURL(). File#toUri() requires read access to the directory containing the file. If the JVM is running with SecurityManager enabled, this file system access may represent a security policy violation (e.g., in Tomcat, the `CATALINA_HOME/bin` folder containing classpath elements such as bootstrap.jar, etc.). In this case, the existing fallback handling can be used.
|
@elkman I can't believe people are still using a One of the most annoying thing about |
|
I found a few more places where |
|
Hi @lukehutch
yes, it is quite annoying, but this particular datacenter (public sector) decided to use it for its managed Tomcat hosting, which includes an option to get a Tomcat instance on a shared VM (like PHP in the 90s, the times without VMs, containers, SELinux and AppArmor).
In fact,
No, I don't know and I also think that there is no easy way to find all missed I could think of a test that sets up a Thank you for the quick response and all your work on classgraph! |
|
You're welcome, and all good points. OK, I think I caught most of them. I searched for all uses of We can just leave it at that for now, but please report any further problems. Thanks! |
Hi @lukehutch,
yes, it's me and SecurityManger again =)
We have a new SecurityException after upgrading from 4.8.69 to 4.8.129 with our SecurityManager enabled Tomcat target platform.
In ClasspathOrder, class path elements are converted to URLs by
pathElementURL = new File(pathElementToStr).toURI().toURL().File#toUri() requires read access to the directory containing the file. If the JVM is running with SecurityManager enabled, this file system access may represent a security policy violation (e.g., in Tomcat, the
CATALINA_HOME/binfolder containing classpath elements such as bootstrap.jar, etc.).In this case, the existing fallback handling can be used.
This PR works fine in our case, but we are only searching for some WebJars.