United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-8021257 com.sun.corba.se.** should be on restricted package list
JDK-8021257 : com.sun.corba.se.** should be on restricted package list

Details
Type:
Bug
Submit Date:
2013-07-24
Status:
Closed
Updated Date:
2014-02-12
Project Name:
JDK
Resolved Date:
2013-10-22
Component:
other-libs
OS:
Sub-Component:
corba
CPU:
Priority:
P2
Resolution:
Fixed
Affected Versions:
7-pool,8
Fixed Versions:

Related Reports
Backport:
Backport:
Backport:
Backport:
Backport:
Backport:
Backport:
Backport:
Backport:
Relates:
Relates:

Sub Tasks

Description
If com.sun.corba.se.impl packages are to be restricted, then a review of all calling sites into such packages needs to be carried out. The initial attempt (JDK-8000450) was unsuccessful. JCK testing found issue when security manager was installed. 

The original ORB.init issue can be resolved easily but that fix highlighted more issues : 
i.e : 
java.lang.NoClassDefFoundError: Could not initialize class com.sun.corba.se.impl.ior.iiop.MaxStreamFormatVersionComponentImpl
    at com.sun.corba.se.spi.ior.iiop.IIOPFactories.makeMaxStreamFormatVersionComponent(IIOPFactories.java:174)
    at com.sun.corba.se.impl.transport.SocketOrChannelAcceptorImpl.addToIORTemplate(SocketOrChannelAcceptorImpl.java:361)
    at com.sun.corba.se.impl.transport.CorbaTransportManagerImpl.addToIORTemplate(CorbaTransportManagerImpl.java:238)

==

Each call creating a new instance of com.sun.corba.se.impl.* objects needs to be checked. Once that code is corrected, we can add the private com.sun.corba.se.impl.* packages to the restricted list.
                                    

Comments
URL:   http://hg.openjdk.java.net/jdk8/tl/corba/rev/52ad44f9a3ec
User:  alanb
Date:  2013-10-22 10:45:03 +0000

                                     
2013-10-22
URL:   http://hg.openjdk.java.net/jdk8/tl/jdk/rev/6f9515a9519f
User:  alanb
Date:  2013-10-22 10:48:59 +0000

                                     
2013-10-22
currently looking at restricting com.sun.corba.**, as suggested by Alan
modified ORB.init to only use reflection for "external" ORB class, and instantiate
SE ORB class directly. javax.rmi.CORBA.Util delegate also instantiates the
SE default delegate directly. Reflection used only for "external" delegate class.
JCK (org_omg, jaxa_rmi, javax_rmi, javax_naming, javax_management) look ok,
 currently running the CORBA test suite.
                                     
2013-10-14
SQE completed PIT testing with the 7u-CPU nightly build:
http://st2.ru.oracle.com/StatusTool2/faces/queryresult2.jsp?matrix_id=1000027128

No new failures. SQE OK to take the fix into CPU14_01.
                                     
2013-11-01
URL:   http://hg.openjdk.java.net/jdk8/jdk8/corba/rev/52ad44f9a3ec
User:  lana
Date:  2013-11-05 20:13:31 +0000

                                     
2013-11-05
URL:   http://hg.openjdk.java.net/jdk8/jdk8/jdk/rev/6f9515a9519f
User:  lana
Date:  2013-11-05 21:09:17 +0000

                                     
2013-11-05



Hardware and Software, Engineered to Work Together