[BATIK-1134] Identity theft: batik-js-1.7.jar contains org.mozilla.javascript.ScriptableObject class.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7
• Component/s: Scripting
• Environment: all
• Assignee: Unassigned
• Reporter: Jan Vogt
• Created: 16/Sep/15 14:55
• Updated: 16/Sep/15 15:02

Description

The batik-js-1.7.jar file indirectly required by Geoserver (http://geoserver.org/) contains a class with the fully qualified identifier org.mozilla.javascript.ScriptableObject. But this identifier belongs to https://github.com/mozilla/rhino/blob/master/src/org/mozilla/javascript/ScriptableObject.java.
In my case this leads to serious problems: I am using the Mozilla Rhino library for a geoserver extension and cant control the classpath. At runtime the wrong (your) org.mozilla.javascript.ScriptableObject is used which leads to weird crashes e.g. that the Method ScriptableObject.putConstProperty() can not be resolved. My suggested fix would be to use a conventional identifier like org.apache.batik-js.ScriptableObject that uses your namespace instead of Mozilla's one.