Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-6922

Extra permission may be required for user-defined aggregates

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 10.12.1.1
    • Fix Version/s: None
    • Component/s: SQL
    • Labels:
      None
    • Urgency:
      Low

      Description

      An additional privilege may be needed when running a user-defined aggregate which spills intermediate results to disk. That is a theory raised by discussion on this email thread: http://apache-database.10148.n7.nabble.com/Security-problem-with-ggregate-functions-using-Java-td147236.html The additional privilege needed by the engine jar is:

      permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect";

      It is likely that this situation only arises on JVMs up through JDK 8. I believe that JDK 9 has removed many dependencies on Sun classes.

      It would be worthwhile to try running a user-defined aggregate which spills to disk, and to do this while running under a security manager.

        Attachments

        1. Derby6922_Median.java
          2 kB
          Richard N. Hillegas
        2. derby6922.jar
          2 kB
          Richard N. Hillegas
        3. Derby6922.java
          2 kB
          Richard N. Hillegas

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              rhillegas Richard N. Hillegas
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: