Issue Details (XML | Word | Printable)

Key: DERBY-485
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Minor Minor
Assignee: Daniel John Debrunner
Reporter: Daniel John Debrunner
Votes: 0
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
Derby

SecurityException or LinkageException thrown during loading a class from a database jar incorrectly shuts the engine down.

Created: 03/Aug/05 04:31 AM   Updated: 30/Jun/09 12:14 AM
Return to search
Component/s: SQL
Affects Version/s: 10.1.2.1, 10.2.1.6
Fix Version/s: 10.1.2.1, 10.2.1.6

Time Tracking:
Not Specified

Bug behavior facts: Security
Resolution Date: 30/Sep/05 02:26 AM


 Description  « Hide
In addiing test cases to lang/dcl.test for signed jar files stored in the database I found that if a jar is installed with a tampered class the resulting SecurityException shuts Derby down. Most likely the same would be true for an invalid class hacked into the jar.

 All   Comments   Work Log   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Daniel John Debrunner added a comment - 05/Aug/05 09:31 AM
Revision 230183 Catch SecurityExceptions and LinkageExceptions consistently when loading application
classes (e.g. procedures, functions) and report as a ClassNotFoundException with the text of
the underlying exception. Enhance the test lang/dcl.jar to have a signed jar file as a database
jar, a hacked version of the jar file and a jar file with an invalid class (for a LinkageError).

Daniel John Debrunner added a comment - 20/Sep/05 06:55 AM
Also fixed in 10.1.2 as revision 290286 from trunk 230183

Deepa Remesh added a comment - 30/Sep/05 02:26 AM
reopening to fix fix version