Re: java.util.ResourceBundle bug?

[Eric Blake]

Mark Wielaard wrote:
> 
> I disagree since we should not let "normal" classes give direct access to
> the VM interface classes.
> 
> I looked at the code and I do not understand why you want to call the
> VMClassLoader.defineClass() method. It seems to me that you want to call
> the defineClass() method of the supplied loader.

The problem here is that the supplied ClassLoader parameter may be null,
if you intend for the proxy class to be created by the bootstrap
loader.  For example, in javac you can create a proxy Runnable with null
as its ClassLoader:
  Proxy.newProxyInstance(null, new Class[]{Runnable.class}, myHandler);
In order to create this class without a NullPointerException, you must
defer to the secure VM entry point.

> I do admit that this is
> not possible with the same trick as we could use in java.util with the
> SecurityManager. But since java.util.reflect.Proxy is system code it has
> enough permissions to get at the defineClass() Method and invoke it on
> the supplied loader. Wouldn't something like the following work:
> 
>   Class clazz = (Class) AccessController.doPrivileged
>   (
>     new PrivilegedAction()
>     {
>       Class[] types = {ClassLoader.class, String.class,
>                        byte[].class, int.class, int.class,
>                        /* ProtectionDomain.class */ };
>       Method m = loader.getDeclaredMethod("defineClass", types);
> 
>       Object[] args = {loader, qualName, bytecode, new Integer(0),
>                        new Integer(bytecode.length),
>                        /* Object.class.getProtectionDomain() */ };
>       return m.invoke(loader, args);
>     };
>   }
> 
> Again not actually tested or compiled. (Mostly just copy/paste from the
> current Proxy.java code.)
> 
> Cheers,
> 
> Mark

-- 
This signature intentionally left boring.

Eric Blake             address@hidden
  BYU student, free software programmer