Re: [Springframework-developer] Re: Proxying target classes

[Les A. H. <le...@ha...>]

> Colin Sampaleanu wrote:
> > The class is not final, and there are no final methods. And I was wrong,
> > it actually already implemented one interface, InitializingBean.
>
> I sent a reply before but it didn't show up. I'm pretty sure this is a bug
> that was fixed recently in CGLIB CVS. If you could try with a newer jar
> file I would appreciate it, otherwise let me know how to reproduce the
> problem.

As I've missed the beginning of this thread, I apologize if what I'm about to
ask was the exact same question about Proxying via CGLIB ;)  If not, it still
is related.

We recently came across an issue that might prevent us from using Spring
(because of CGLIB dependencies) in client-tier swing/webstart/applet
deployments.

We have to sign our swing deployment jars.  After the user accepts the signed
application, it is then assigned its own protection domain for that codesource,
as per J2SE security specs.  In some of our classes, we use a custom CGLIB
proxy to wrap access to ejb handles.  We're using the CGLIB jar that came with
the SpringFramework v. 1.0 M4.

The problem is that java.security.ProtectionDomain of the CGLIB generated class
is _not_ the same of the application classes loaded by the trusted classloader.
 Because of this, Exceptions are thrown all over the place when we try to use
that runtime-generated class.

java.lang.reflect.Proxy does not have this problem.  From the 1.4.2 J2SE API:

"The java.security.ProtectionDomain of a proxy class is the same as that of
system classes loaded by the bootstrap class loader, such as java.lang.Object,
because the code for a proxy class is generated by trusted system code. This
protection domain will typically be granted java.security.AllPermission"

This implies that any generated classes created by Spring's use of CGLIB would
not work either in a signed environment.

Our application server (which also uses CGLIB in some cases) does not have this
problem because it is granted the AllPermission upon startup, so we are happily
using Spring there.

This is clearly a CGLIB problem.  Has anyone on the Spring team addressed this
issue?  Do you know if there is a newer version of the CGLIB distribution that
solves this problem?

Luckily, a java.lang.reflect.Proxy conversion from our CGLIB implementation went
smoothly, but I consider that a workaround.  Just looking for information, and
seeing what you folks know about the problem...

Regards,

Les