[DERBY-4292] creation of FileInputStream in org.apache.derby.impl.tools.ij.Main not wrapped in privilege block which can cause problems running under SecurityManager

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.1.3.1, 10.2.2.0, 10.3.2.1, 10.4.2.0, 10.5.1.1, 10.6.1.0
• Fix Version/s: 10.5.3.0, 10.6.1.0
• Component/s: Tools
• Urgency: Normal
• Issue & fix info: High Value Fix, Newcomer, Repro attached
• Bug behavior facts: Security
• Assignee: Tiago R. Espinha
• Reporter: Katherine Marsden
• Created: 25/Jun/09 19:42
• Updated: 06/Aug/09 11:01
• Resolved: 18/Jul/09 04:37

Description

org.apache.derby.impl.tools.ij.Main has this code where the call to FileInputStream is not wrapped in a privilege block:

try {
in1 = new FileInputStream(file);
if (in1 != null)

{ in1 = new BufferedInputStream(in1, utilMain.BUFFEREDFILESIZE); in = langUtil.getNewInput(in1); }

} catch (FileNotFoundException e) {
if (Boolean.getBoolean("ij.searchClassPath"))

{ in = langUtil.getNewInput(util.getResourceAsStream(file)); }

This can cause issues when running under SecurityManager