This is more a rant than classic post, but I hope it may help someone or someone could prove me wrong, which would be even better.
In recent app I use XPages Scaffolding from Jesse Gallagher. He does some magic in his code that relies on Java reflection to access classes that you can define in your NSF as your model. As my dev server had Java AllPermission grant in global block of java.policy everything worked just fine. But just until I moved the app to production server, where this setting is not possible.
I started to get Exceptions like:
The stack trace shows that the exception is thrown from internal Notes class that tries to enforce security.
I still thought that is is not a big deal, since I'm allowed to modify java.policy on this server, so I would just grant correct permission to my app using grant codeBase "xspnsf://" syntax. But it just don't work. I checked XPages Portable Command Guide and other sources to see if I spelled it correctly. I tried to debug the code and validate the permission in code, it just looked OK. But it had no impact on the exception. Than I found a note in release notes of Threads and Jobs project.
The problem is caused by using some reflection calls between classes that are loaded by different classloaders. To kill this check you have to play games with SecurityManager and currentClassLoader() . So I decided to use AccessController.doPriviledges and wrap all code that caused my troubles into PrivilegedActions.
It is not the nicest solution for code readability, but it solved my problem and I can continue to focus on my app and not fighting with the platform.
It took me couple hours to solve this issue and if anyone uses Scaffolding and has similar problem, you can try to use my fork, where these changes are implemented - https://github.com/mpradny/XPages-Scaffolding/tree/feature/priviledged (code probably needs some refactoring, since this is still first version that worked)
If anyone can show me that java.policy setting for a nsf could solve this problems, let me know. I have seen many posts on Stackoverflow where people couldn't get it to work and probably just ended up with AllPermission in global block.
In recent app I use XPages Scaffolding from Jesse Gallagher. He does some magic in his code that relies on Java reflection to access classes that you can define in your NSF as your model. As my dev server had Java AllPermission grant in global block of java.policy everything worked just fine. But just until I moved the app to production server, where this setting is not possible.
I started to get Exceptions like:
java.lang.SecurityException: not allowed to access members in class class model.Problem
lotus.notes.AgentSecurityManager.checkMemberAccess(Unknown Source) java.lang.Class.checkMemberAccess(Class.java:123) java.lang.Class.getDeclaredFields(Class.java:601) frostillicus.xsp.model.AbstractModelObject.getGenericType(AbstractMo delObject.java:215) frostillicus.xsp.model.domino.AbstractDominoModel.setValueImmediate (AbstractDominoModel.java:271) frostillicus.xsp.model.domino.AbstractDominoModel.initFromDatabase (AbstractDominoModel.java:64) model.Problem.initFromDatabase(Problem.java:56)
The stack trace shows that the exception is thrown from internal Notes class that tries to enforce security.
I still thought that is is not a big deal, since I'm allowed to modify java.policy on this server, so I would just grant correct permission to my app using grant codeBase "xspnsf://" syntax. But it just don't work. I checked XPages Portable Command Guide and other sources to see if I spelled it correctly. I tried to debug the code and validate the permission in code, it just looked OK. But it had no impact on the exception. Than I found a note in release notes of Threads and Jobs project.
Note that the following does not work since the Java code is put as class in NSF as opposed to a jar file in the/lib directory:I'm not willing to put my code into a jar as it would make development much harder, so I had to look for another solution.
grant codeBase "xspnsf://server:0/threadsjob.nsf/-" {
permission java.security.AllPermission;
};
The problem is caused by using some reflection calls between classes that are loaded by different classloaders. To kill this check you have to play games with SecurityManager and currentClassLoader() . So I decided to use AccessController.doPriviledges and wrap all code that caused my troubles into PrivilegedActions.
It is not the nicest solution for code readability, but it solved my problem and I can continue to focus on my app and not fighting with the platform.
It took me couple hours to solve this issue and if anyone uses Scaffolding and has similar problem, you can try to use my fork, where these changes are implemented - https://github.com/mpradny/XPages-Scaffolding/tree/feature/priviledged (code probably needs some refactoring, since this is still first version that worked)
If anyone can show me that java.policy setting for a nsf could solve this problems, let me know. I have seen many posts on Stackoverflow where people couldn't get it to work and probably just ended up with AllPermission in global block.
Comments
Post a Comment