Commons Logging
  1. Commons Logging
  2. LOGGING-106

AccessControlException when loading LogFactory class without system properties permission

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 1.1.0
    • Fix Version/s: 1.1.1
    • Labels:
      None

      Description

      The LogFactory static initializer calls createFactoryStore which calls System.getProperty. If the class doesn't have access rights to see system properties (eg when in an applet) then the LogFactory class cannot load, and hence the app is completely stuffed.

      I think the system property access should be wrapped in a try/catch, with any access failure behaving as if the propery is not set.

      In addition, we might want to use an AccessController in the static block so that a signed logging jar can be granted system property access [without having to grant all its callers that permission too].

        Activity

        Hide
        Simon Kitching added a comment -

        Fixed by SVN r423654.

        Re the last paragraph above, using an AccessController too broadly is a security risk so this should not be done.

        Show
        Simon Kitching added a comment - Fixed by SVN r423654. Re the last paragraph above, using an AccessController too broadly is a security risk so this should not be done.

          People

          • Assignee:
            Unassigned
            Reporter:
            Simon Kitching
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development