[CXF-7467] WSDLManagerImpl requires privileged actions in order to work under a security manager

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.12
• Fix Version/s: 3.1.13, 3.2.0
• Component/s: JAX-WS Runtime
• Labels: security
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Ingo Weiss
• Created: 09/Aug/17 08:20
• Updated: 28/Nov/17 10:42
• Resolved: 11/Aug/17 15:22

Description

When using CXF and WSDL under a security manager, security related exceptions are thrown, making initialisation of WSDLManagerImpl fail.

Caused by: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.io.FilePermission" "/Library/Java/JavaVirtualMachines/jdk1.8.0_144.jdk/Contents/Home/jre/lib/wsdl.properties" "read")" in code source "(vfs:/content/executorService.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.executorService.war" from Service Module Loader")
	at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:278)
	at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:175)
	at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
	at org.wildfly.security.manager.WildFlySecurityManager.checkRead(WildFlySecurityManager.java:350)
	at java.io.FileInputStream.<init>(FileInputStream.java:127)
	at javax.wsdl.factory.WSDLFactory.findFactoryImplName(WSDLFactory.java:243)
	at javax.wsdl.factory.WSDLFactory.newInstance(WSDLFactory.java:60)
	at org.apache.cxf.wsdl11.WSDLManagerImpl.<init>(WSDLManagerImpl.java:84)
	at org.apache.cxf.wsdl11.WSDLManagerImpl.<init>(WSDLManagerImpl.java:80)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at org.apache.cxf.bus.extension.Extension.load(Extension.java:249)
	at org.apache.cxf.bus.extension.Extension.load(Extension.java:261)
	at org.apache.cxf.bus.extension.ExtensionManagerImpl.loadAndRegister(ExtensionManagerImpl.java:213)
	at org.apache.cxf.bus.extension.ExtensionManagerImpl.getBeanOfType(ExtensionManagerImpl.java:320)
	at org.apache.cxf.bus.extension.ExtensionManagerBus.getExtension(ExtensionManagerBus.java:215)
	at org.apache.cxf.jaxws.ServiceImpl.initializePorts(ServiceImpl.java:169)
	at org.apache.cxf.jaxws.ServiceImpl.initialize(ServiceImpl.java:160)
	at org.apache.cxf.jaxws.ServiceImpl.<init>(ServiceImpl.java:129)
...

Issue Links

• links to: GitHub Pull Request #303
• links to: GitHub Pull Request #304