Uploaded image for project: 'Felix'
  1. Felix
  2. FELIX-4197

[CM] Always check permission on Configuration.get/setBundleLocation

    XMLWordPrintableJSON

Details

    Description

      If the Configuration.getBundleLocation or Configuration.setBundleLocation is called, the permission is only checked if the current (or new) location is not the same as the calling bundle's own location. This is assumption is derived from 104.11.1 (Configuration Admin in Compendium Spec):

      > Every bundle has the implicit right to receive and configure configurations
      > with a location that exactly matches the Bundle’s location or that is null.

      Yet this assumption is wrong because this would allow bundles to actually circumvent the permissions set on the Bundle.getLocation() method requiring AdminPermission[this,METADATA] and to allow bundles to get to their locations without permission checking.

      The correct assumption is, that only CRUD configuration (properties) itself is allowed but not CRUD on the configuration's location binding.

      Attachments

        Activity

          People

            fmeschbe Felix Meschberger
            fmeschbe Felix Meschberger
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: