Derby
  1. Derby
  2. DERBY-5352

Derby table functions stored in a jar file inside the database which implement VTICosting or RestrictedVTI fail with ClassNotFoundException

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 10.8.1.2
    • Fix Version/s: 10.8.2.2, 10.9.1.0
    • Component/s: SQL
    • Labels:
      None
    • Urgency:
      Urgent

      Description

      Derby table functions stored in a jar file inside the database which implement VTICosting or RestrictedVTI fail with ClassNotFoundException. This occurs when you attempt to query the table function. If you put the JAR on the classpath instead, then the table function can be accessed correctly.

      I believe the problem is in JarLoader.java which has:

      // Classes in installed jars cannot reference
      // Derby internal code. This is to avoid
      // code in installed jars bypassing SQL
      // authorization by calling Derby's internal methods.
      //
      // Any classes in the org.apache.derby.jdbc package
      // are allowed as it allows routines to make JDBC
      // connections to other databases. This does expose
      // public classes in that package that are not part
      // of the public api to attacks. One could attempt
      // further limiting allowed classes to those starting
      // with Embedded (and Client) but when fetching the
      // default connection in a routine (jdbc:default:connection)
      // the DriverManager attempts a load of the already loaded
      // AutoloadDriver, I think to establish the calling class
      // has access to the driver.
      //
      // This check in addition to the one in UpdateLoader
      // that prevents restricted classes from being loaded
      // from installed jars. The checks should be seen as
      // independent, ie. the restricted load check should
      // not make assumptions about this check reducing the
      // number of classes it has to check for.
      if (className.startsWith("org.apache.derby.")
      && !className.startsWith("org.apache.derby.jdbc."))

      { ClassNotFoundException cnfe = new ClassNotFoundException(className); //cnfe.printStackTrace(System.out); throw cnfe; }

      Which explicitly restricts access to the org.apache.derby package except for org.apache.derby.jdbc. I have debugged this and if change this to:

      // Classes in installed jars cannot reference
      // Derby internal code. This is to avoid
      // code in installed jars bypassing SQL
      // authorization by calling Derby's internal methods.
      if (className.startsWith("org.apache.derby.")
      && !className.startsWith("org.apache.derby.jdbc.")
      && !className.startsWith("org.apache.derby.vti."))
      { ClassNotFoundException cnfe = new ClassNotFoundException(className); //cnfe.printStackTrace(System.out); throw cnfe; }

      The access is allowed.

      1. derby-5352.diff
        0.8 kB
        Brett Bergquist
      2. derby-5352-01-ab-fixWithRegressionTest.diff
        4 kB
        Rick Hillegas

        Issue Links

          Activity

          Hide
          Knut Anders Hatlen added a comment -

          [bulk update] Close all resolved issues that haven't been updated for more than one year.

          Show
          Knut Anders Hatlen added a comment - [bulk update] Close all resolved issues that haven't been updated for more than one year.
          Hide
          Rick Hillegas added a comment -

          Resolving this issue since I believe no further work is needed.

          Show
          Rick Hillegas added a comment - Resolving this issue since I believe no further work is needed.
          Hide
          Rick Hillegas added a comment -

          Ported 1153474 from the trunk to the 10.8 branch at subversion revision 1153478.

          Show
          Rick Hillegas added a comment - Ported 1153474 from the trunk to the 10.8 branch at subversion revision 1153478.
          Hide
          Rick Hillegas added a comment -

          I see Brett's CLA on file. Committed derby-5352-01-ab-fixWithRegressionTest.diff at subversion revision 1153474.

          Show
          Rick Hillegas added a comment - I see Brett's CLA on file. Committed derby-5352-01-ab-fixWithRegressionTest.diff at subversion revision 1153474.
          Hide
          Rick Hillegas added a comment -

          All regression tests passed cleanly for me. This patch is ready for commit once we clear up the CLA issue. Thanks.

          Show
          Rick Hillegas added a comment - All regression tests passed cleanly for me. This patch is ready for commit once we clear up the CLA issue. Thanks.
          Hide
          Rick Hillegas added a comment -

          Hi Brett,

          Have you signed the Apache Contributor License Agreement? I don't see your name on the list of contributors who have signed a CLA: http://people.apache.org/committer-index.html . The community will want you to submit one before we can commit your work. If your current employment agreement assigns your inventions to your employer, your company may need to sign a corporate CLA as well. See: http://www.apache.org/licenses/#clas . Thanks.

          Show
          Rick Hillegas added a comment - Hi Brett, Have you signed the Apache Contributor License Agreement? I don't see your name on the list of contributors who have signed a CLA: http://people.apache.org/committer-index.html . The community will want you to submit one before we can commit your work. If your current employment agreement assigns your inventions to your employer, your company may need to sign a corporate CLA as well. See: http://www.apache.org/licenses/#clas . Thanks.
          Hide
          Rick Hillegas added a comment -

          Running full regression tests now.

          Show
          Rick Hillegas added a comment - Running full regression tests now.
          Hide
          Rick Hillegas added a comment -

          Thanks for the patch, Brett. It looks good to me. Attaching derby-5352-01-ab-fixWithRegressionTest.diff. This adds a regression test to verify that the fix works. The test fails without your change and succeeds with your change.

          Touches the following files:

          -----------

          M java/engine/org/apache/derby/impl/services/reflect/JarLoader.java

          Brett's fix.

          -----------

          M java/testing/org/apache/derbyTesting/functionTests/tests/lang/dummy_vti.jar
          M java/testing/org/apache/derbyTesting/functionTests/tests/lang/DatabaseClassLoadingTest.java

          Adds a restricted table function to dummy_vti.jar and verifies that it loads and runs.

          Show
          Rick Hillegas added a comment - Thanks for the patch, Brett. It looks good to me. Attaching derby-5352-01-ab-fixWithRegressionTest.diff. This adds a regression test to verify that the fix works. The test fails without your change and succeeds with your change. Touches the following files: ----------- M java/engine/org/apache/derby/impl/services/reflect/JarLoader.java Brett's fix. ----------- M java/testing/org/apache/derbyTesting/functionTests/tests/lang/dummy_vti.jar M java/testing/org/apache/derbyTesting/functionTests/tests/lang/DatabaseClassLoadingTest.java Adds a restricted table function to dummy_vti.jar and verifies that it loads and runs.
          Hide
          Brett Bergquist added a comment -

          Patch against JarLoader.java to explicitly add in access to "org.apache.derby.vti." access.

          Show
          Brett Bergquist added a comment - Patch against JarLoader.java to explicitly add in access to "org.apache.derby.vti." access.
          Hide
          Rick Hillegas added a comment -

          Your solution looks good to me, Brett. Along with a regression test, it will probably fix the problem. I am closing DERBY-5366, which duplicates this bug. Thanks.

          Show
          Rick Hillegas added a comment - Your solution looks good to me, Brett. Along with a regression test, it will probably fix the problem. I am closing DERBY-5366 , which duplicates this bug. Thanks.

            People

            • Assignee:
              Brett Bergquist
              Reporter:
              Brett Bergquist
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development