[BVAL-92] Security holes in org.apache.bval.util.PrivilegedActions

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.2-incubating, 0.3-incubating, 0.4
• Fix Version/s: 0.4
• Assignee: Roman Stumm
• Reporter: Jörg Waßmer
• Created: 08/Mar/11 00:24
• Updated: 13/Apr/12 17:43
• Resolved: 25/Aug/11 17:20

Description

PrivilegedActions is public. It offers several method, e.g. getClassLoader() which are executed surrounded by privileged actions. Thus any caller can get e.g. a classloader, even if the caller has not the required permissions.

PrivilegedActions should offer only factory methods creating the privileged actions. Then the callers should call AccessController.doPrivileged() for themselves, such that the actions will be executed in the caller's security domain, instead of the domain of the BeanValidation API.