Menu
▾
▴
Re: [Jython-users] How to implement java class level security
|
From: <nee...@ha...> - 2006-01-05 07:51:22
|
<BODY><SPAN>
<P>
<P></P>
<P>Hi Moss,<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></P>
<P>Thanks for the reply. I tried implementing the class loader as per your suggestion. (I had earlier also given this a shot but had just overloaded findClass()). Now I overloaded the loadClass() method. I have a class internal.Document that I dont want the Python script to access. But when I do this in the script -<o:p></o:p></P>
<P><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Courier">System.out.println("Script - Trying to call Document.getDoc()")<BR>import internal.Document<BR>doc = internal.Document()<BR>doc.getDoc()</SPAN><o:p></o:p></P>
<P>The loadClass method is not called from the HidingClassLoader. Any idea what is going wrong. I have attached the java project for your reference.<o:p></o:p></P>
<P>Regards,</P>
<P>Neeraj</P>
<P>PS: Couldnt send a zip (mail server blocked it) so pasting all the classes below. The main class is Starter.java</P>
<P><STRONG>Document.java</STRONG></P>
<P><FONT face=Courier size=1>package internal;</FONT></P>
<P><FONT face=Courier size=1>public class Document {<BR> public Document() {<BR> super();<BR> System.out.println("Document instantiated ...5");<BR> }</FONT></P>
<P><FONT face=Courier size=1> public void getDoc() {<BR> System.out.println("Document.getDoc() called .. Giving Doc");<BR> }<BR>}</FONT></P>
<P> </P>
<P><STRONG>ScriptRunner.java</STRONG></P>
<P><FONT face=Courier size=1>package main;</FONT></P>
<P><FONT face=Courier size=1>import org.python.util.PythonInterpreter;<BR>import org.python.core.*;</FONT></P>
<P><FONT face=Courier size=1>// This simple code executes a Python script<BR>public class ScriptRunner {<BR> public void runScript(String arg) {<BR> long t;<BR> PythonInterpreter i = new PythonInterpreter();<BR> System.out.println("About to use Jython to interpret script: " + arg);<BR> try {<BR> i.execfile(arg);<BR> System.out.println("Script " + arg + " executed successfully");<BR> } catch (Exception e) {<BR> System.out.println("Exception while sourcing file " + arg);<BR> System.out.println(e.toString());<BR> }<BR>
}<BR> }</FONT></P>
<P> </P>
<P><STRONG>DocProxy.java</STRONG></P>
<P><FONT face=Courier size=1>package main;</FONT></P>
<P><FONT face=Courier size=1>import internal.Document;</FONT></P>
<P><FONT face=Courier size=1>public class DocProxy {</FONT></P>
<P><FONT face=Courier size=1> public void getDocProxy() {<BR> Document doc = new Document();<BR> doc.getDoc();<BR> }<BR>}<BR></FONT></P>
<P><STRONG>HidingClassLoader.java</STRONG></P>
<P>
<P><FONT face=Courier size=1>package main;</FONT></P>
<P><FONT face=Courier size=1>public class HidingClassLoader extends ClassLoader {<BR> public HidingClassLoader(ClassLoader parent) {<BR> super(parent);<BR> }</FONT></P>
<P><FONT face=Courier size=1> /* <BR> Note that you need to override loadClass instead of findClass, because otherwise the<BR> normal search scheme would look at the parent loader first.<BR> */<BR> public Class loadClass(String name) throws ClassNotFoundException {<BR> if (name.startsWith("com.foo.secretstuff."))<BR> throw new ClassNotFoundException(name);<BR> System.out.println("Trying to load class " + name);</FONT></P>
<P><FONT face=Courier size=1> return getParent().loadClass(name);<BR> }</FONT></P>
<P><FONT face=Courier size=1> protected Class findClass(String name) throws ClassNotFoundException {<BR> System.out.println("Trying to find class " + name);<BR> return super.findClass(name);<BR> }</FONT></P>
<P><FONT face=Courier size=1>}</FONT></P>
<P><STRONG>MyApp.java</STRONG></P>
<P><FONT face=Courier size=1>package main;</FONT></P>
<P><FONT face=Courier size=1>public class MyApp {<BR> void startMyApp()<BR> {<BR> System.out.println("Starting My App");<BR> ClassLoader loader = new HidingClassLoader(getClass().getClassLoader());<BR> try {<BR> Class docClass = loader.loadClass("main.DocProxy");<BR> DocProxy dp = (DocProxy) docClass.newInstance();<BR> dp.getDocProxy(); <BR> // This should call HidingClassLoader.loadClass() but it isnt called<BR> <BR> Class interpClass = loader.loadClass("main.ScriptRunner");<BR> ScriptRunner sr = (ScriptRunner) interpClass.newInstance();<BR> sr.runScript("hello.py");<BR> } catch (Exception e) {<BR> e.printStackTrace();<BR> }<BR> }<BR> <BR> public void stopMyApp() {<BR> System.out.println("Stopping My App");<BR> }<BR>}<BR></FONT>
</P>
<P><STRONG>Starter.java</STRONG></P>
<P><FONT face=Courier size=1>package main;</FONT></P>
<P><FONT face=Courier size=1>public class Starter<BR>{<BR> public static void main(String st[]) throws Exception<BR> {<BR> MyApp sa = new MyApp();<BR> sa.startMyApp();<BR> }<BR>}<BR></FONT></P>
<P><STRONG>hello.py</STRONG></P>
<P><FONT face=Courier size=1>from java.lang import System</FONT></P>
<P><FONT face=Courier size=1>System.out.println("Script - Trying to call Document.getDoc()")<BR>import internal.Document<BR>doc = internal.Document()<BR>doc.getDoc()</FONT></P>
<P><FONT face=Courier size=1>System.out.println("Script - Trying to call stopMyApp()")<BR>import main.MyApp<BR>app = main.MyApp()<BR>app.stopMyApp()</FONT></P>
<P><FONT face=Courier size=1></FONT> </P></SPAN></BODY>
|