[LOGGING-26] Security policy configuration, SimpleLog uses System.getProperties()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Nightly Builds
• Fix Version/s: 1.0.3

Environment

Operating System: Solaris
Platform: PC

• Bugzilla Id: 9743
• Assignee: Unassigned
• Reporter: Glenn Nielsen
• Created: 10/Jun/02 20:03
• Updated: 29/Dec/09 17:08
• Resolved: 29/Dec/09 17:08

Description

SimpleLog uses System.getProperties to get a list of existing
org.apache.commons.logging.* properties.

If commons-logging is running within an application which uses
the Java SecurityManager such as Tomcat this requires granting
java.util.PropertyPermission "*", "read" to not only
commongs-logging.jar, but all other jar files with classes
on the stack.

This makes it impossible to restrict access to reading properties
for any API's on the stack.

SimpleLog should get each individual property it needs separately.

This would apply to any other code which uses System.getProperties() also.