[DERBY-6629] Restrict privileged operation in CreateXMLFile

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.10.2.0
• Fix Version/s: 10.11.1.1
• Component/s: Tools
• Labels: derby_backport_reject_10_10
• Assignee: Knut Anders Hatlen
• Reporter: Knut Anders Hatlen
• Created: 20/Jun/14 11:43
• Updated: 09/Sep/16 09:53
• Resolved: 14/Oct/14 20:55

Description

The PlanExporter tool has a public method CreateXMLFile.writeTheXMLFile(). This method opens a FileOutputStream in a privileged block. We should change this so that unprivileged code cannot use the method to write files using derbytools.jar's privileges.