Skip to content

Commit 99f33ed

Browse files
wilkinsonawilkinsona
committed
Remove SecurityManager support
Closes spring-projectsgh-28213
1 parent 814c86c commit 99f33ed

File tree

11 files changed

+35
-85
lines changed

11 files changed

+35
-85
lines changed

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/condition/OnClassCondition.java

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2020 the original author or authors.
2+
* Copyright 2012-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
1616

1717
package org.springframework.boot.autoconfigure.condition;
1818

19-
import java.security.AccessControlException;
2019
import java.util.ArrayList;
2120
import java.util.Collections;
2221
import java.util.List;
@@ -78,12 +77,7 @@ private OutcomesResolver createOutcomesResolver(String[] autoConfigurationClasse
7877
AutoConfigurationMetadata autoConfigurationMetadata) {
7978
OutcomesResolver outcomesResolver = new StandardOutcomesResolver(autoConfigurationClasses, start, end,
8079
autoConfigurationMetadata, getBeanClassLoader());
81-
try {
82-
return new ThreadedOutcomesResolver(outcomesResolver);
83-
}
84-
catch (AccessControlException ex) {
85-
return outcomesResolver;
86-
}
80+
return new ThreadedOutcomesResolver(outcomesResolver);
8781
}
8882

8983
@Override

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/JspTemplateAvailabilityProvider.java

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2019 the original author or authors.
2+
* Copyright 2012-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,7 +17,6 @@
1717
package org.springframework.boot.autoconfigure.web.servlet;
1818

1919
import java.io.File;
20-
import java.security.AccessControlException;
2120

2221
import org.springframework.boot.autoconfigure.template.TemplateAvailabilityProvider;
2322
import org.springframework.core.env.Environment;
@@ -43,11 +42,7 @@ public boolean isTemplateAvailable(String view, Environment environment, ClassLo
4342
if (resourceLoader.getResource(resourceName).exists()) {
4443
return true;
4544
}
46-
try {
47-
return new File("src/main/webapp", resourceName).exists();
48-
}
49-
catch (AccessControlException ex) {
50-
}
45+
return new File("src/main/webapp", resourceName).exists();
5146
}
5247
return false;
5348
}

‎spring-boot-project/spring-boot-cli/src/main/java/org/springframework/boot/cli/compiler/ExtendedGroovyClassLoader.java

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2020 the original author or authors.
2+
* Copyright 2012-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,8 +23,6 @@
2323
import java.net.MalformedURLException;
2424
import java.net.URL;
2525
import java.net.URLClassLoader;
26-
import java.security.AccessController;
27-
import java.security.PrivilegedAction;
2826
import java.util.ArrayList;
2927
import java.util.Enumeration;
3028
import java.util.HashMap;
@@ -124,12 +122,11 @@ public InputStream getResourceAsStream(String name) {
124122

125123
@Override
126124
public ClassCollector createCollector(CompilationUnit unit, SourceUnit su) {
127-
InnerLoader loader = AccessController.doPrivileged(getInnerLoader());
128-
return new ExtendedClassCollector(loader, unit, su);
125+
return new ExtendedClassCollector(getInnerLoader(), unit, su);
129126
}
130127

131-
private PrivilegedAction<InnerLoader> getInnerLoader() {
132-
return () -> new InnerLoader(ExtendedGroovyClassLoader.this) {
128+
private InnerLoader getInnerLoader() {
129+
return new InnerLoader(ExtendedGroovyClassLoader.this) {
133130

134131
// Don't return URLs from the inner loader so that Tomcat only
135132
// searches the parent. Fixes 'TLD skipped' issues

‎spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/restart/classloader/RestartClassLoader.java

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@
2020
import java.net.MalformedURLException;
2121
import java.net.URL;
2222
import java.net.URLClassLoader;
23-
import java.security.AccessController;
24-
import java.security.PrivilegedAction;
2523
import java.security.ProtectionDomain;
2624
import java.util.Enumeration;
2725

@@ -125,7 +123,7 @@ public URL findResource(String name) {
125123
if (file.getKind() == Kind.DELETED) {
126124
return null;
127125
}
128-
return AccessController.doPrivileged((PrivilegedAction<URL>) () -> createFileUrl(name, file));
126+
return createFileUrl(name, file);
129127
}
130128

131129
@Override
@@ -162,10 +160,8 @@ protected Class<?> findClass(String name) throws ClassNotFoundException {
162160
if (file.getKind() == Kind.DELETED) {
163161
throw new ClassNotFoundException(name);
164162
}
165-
return AccessController.doPrivileged((PrivilegedAction<Class<?>>) () -> {
166-
byte[] bytes = file.getContents();
167-
return defineClass(name, bytes, 0, bytes.length);
168-
});
163+
byte[] bytes = file.getContents();
164+
return defineClass(name, bytes, 0, bytes.length);
169165
}
170166

171167
@Override

‎spring-boot-project/spring-boot-docs/src/docs/asciidoc/features/spring-application.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,16 @@ When your application starts, you should see something similar to the following
2020
=========|_|==============|___/=/_/_/_/
2121
:: Spring Boot :: v{spring-boot-version}
2222
23-
2021-02-03 10:33:25.224 INFO 17321 --- [ main] o.s.b.d.s.s.SpringApplicationExample : Starting SpringApplicationExample using Java 1.8.0_232 on mycomputer with PID 17321 (/apps/myjar.jar started by pwebb)
24-
2021-02-03 10:33:25.226 INFO 17900 --- [ main] o.s.b.d.s.s.SpringApplicationExample : No active profile set, falling back to default profiles: default
25-
2021-02-03 10:33:26.046 INFO 17321 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port(s): 8080 (http)
23+
2021-02-03 10:33:25.224 INFO 17900 --- [ main] o.s.b.d.s.s.SpringApplicationExample : Starting SpringAppplicationExample using Java 17 on mycomputer with PID 17321 (/apps/myjar.jar started by pwebb)
24+
2021-02-03 10:33:25.226 INFO 17900 --- [ main] o.s.b.d.s.s.SpringApplicationExample : No active profile set, falling back to default profiles: default
25+
2021-02-03 10:33:26.046 INFO 17900 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port(s): 8080 (http)
2626
2021-02-03 10:33:26.054 INFO 17900 --- [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat]
2727
2021-02-03 10:33:26.055 INFO 17900 --- [ main] org.apache.catalina.core.StandardEngine : Starting Servlet engine: [Apache Tomcat/9.0.41]
2828
2021-02-03 10:33:26.097 INFO 17900 --- [ main] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring embedded WebApplicationContext
2929
2021-02-03 10:33:26.097 INFO 17900 --- [ main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 821 ms
3030
2021-02-03 10:33:26.144 INFO 17900 --- [ main] s.tomcat.SampleTomcatApplication : ServletContext initialized
3131
2021-02-03 10:33:26.376 INFO 17900 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http) with context path ''
32-
2021-02-03 10:33:26.384 INFO 17900 --- [ main] o.s.b.d.s.s.SpringApplicationExample : Started SampleTomcatApplication in 1.514 seconds (JVM running for 1.823)
32+
2021-02-03 10:33:26.384 INFO 17900 --- [ main] o.s.b.d.s.s.SpringApplicationExample : Started SampleTomcatApplication in 1.514 seconds (JVM running for 1.823)
3333
----
3434

3535

‎spring-boot-project/spring-boot-docs/src/docs/asciidoc/getting-started/system-requirements.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[[getting-started.system-requirements]]
22
== System Requirements
3-
Spring Boot {spring-boot-version} requires https://www.java.com[Java 8] and is compatible up to and including Java 17.
3+
Spring Boot {spring-boot-version} requires https://www.java.com[Java 17].
44
{spring-framework-docs}/[Spring Framework {spring-framework-version}] or above is also required.
55

66
Explicit build support is provided for the following build tools:

‎spring-boot-project/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/LaunchedURLClassLoader.java

Lines changed: 16 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2020 the original author or authors.
2+
* Copyright 2012-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,8 +23,6 @@
2323
import java.net.URL;
2424
import java.net.URLClassLoader;
2525
import java.net.URLConnection;
26-
import java.security.AccessController;
27-
import java.security.PrivilegedExceptionAction;
2826
import java.util.Enumeration;
2927
import java.util.function.Supplier;
3028
import java.util.jar.JarFile;
@@ -213,31 +211,23 @@ private void definePackageIfNecessary(String className) {
213211
}
214212

215213
private void definePackage(String className, String packageName) {
216-
try {
217-
AccessController.doPrivileged((PrivilegedExceptionAction<Object>) () -> {
218-
String packageEntryName = packageName.replace('.', '/') + "/";
219-
String classEntryName = className.replace('.', '/') + ".class";
220-
for (URL url : getURLs()) {
221-
try {
222-
URLConnection connection = url.openConnection();
223-
if (connection instanceof JarURLConnection) {
224-
JarFile jarFile = ((JarURLConnection) connection).getJarFile();
225-
if (jarFile.getEntry(classEntryName) != null && jarFile.getEntry(packageEntryName) != null
226-
&& jarFile.getManifest() != null) {
227-
definePackage(packageName, jarFile.getManifest(), url);
228-
return null;
229-
}
230-
}
231-
}
232-
catch (IOException ex) {
233-
// Ignore
214+
String packageEntryName = packageName.replace('.', '/') + "/";
215+
String classEntryName = className.replace('.', '/') + ".class";
216+
for (URL url : getURLs()) {
217+
try {
218+
URLConnection connection = url.openConnection();
219+
if (connection instanceof JarURLConnection) {
220+
JarFile jarFile = ((JarURLConnection) connection).getJarFile();
221+
if (jarFile.getEntry(classEntryName) != null && jarFile.getEntry(packageEntryName) != null
222+
&& jarFile.getManifest() != null) {
223+
definePackage(packageName, jarFile.getManifest(), url);
224+
return;
234225
}
235226
}
236-
return null;
237-
}, AccessController.getContext());
238-
}
239-
catch (java.security.PrivilegedActionException ex) {
240-
// Ignore
227+
}
228+
catch (IOException ex) {
229+
// Ignore
230+
}
241231
}
242232
}
243233

‎spring-boot-project/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarFile.java

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,7 @@ private JarFile(RandomAccessDataFile rootFile, String pathFromRoot, RandomAccess
128128
private JarFile(RandomAccessDataFile rootFile, String pathFromRoot, RandomAccessData data, JarEntryFilter filter,
129129
JarFileType type, Supplier<Manifest> manifestSupplier) throws IOException {
130130
super(rootFile.getFile());
131-
if (System.getSecurityManager() == null) {
132-
super.close();
133-
}
131+
super.close();
134132
this.rootFile = rootFile;
135133
this.pathFromRoot = pathFromRoot;
136134
CentralDirectoryParser parser = new CentralDirectoryParser();

‎spring-boot-project/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarFileWrapper.java

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,7 @@ class JarFileWrapper extends AbstractJarFile {
4040
JarFileWrapper(JarFile parent) throws IOException {
4141
super(parent.getRootJarFile().getFile());
4242
this.parent = parent;
43-
if (System.getSecurityManager() == null) {
44-
super.close();
45-
}
43+
super.close();
4644
}
4745

4846
@Override

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/SpringApplicationShutdownHook.java

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616

1717
package org.springframework.boot;
1818

19-
import java.security.AccessControlException;
2019
import java.util.Collections;
2120
import java.util.IdentityHashMap;
2221
import java.util.LinkedHashSet;
@@ -84,12 +83,7 @@ private void addRuntimeShutdownHookIfNecessary() {
8483
}
8584

8685
void addRuntimeShutdownHook() {
87-
try {
88-
Runtime.getRuntime().addShutdownHook(new Thread(this, "SpringApplicationShutdownHook"));
89-
}
90-
catch (AccessControlException ex) {
91-
// Not allowed in some environments
92-
}
86+
Runtime.getRuntime().addShutdownHook(new Thread(this, "SpringApplicationShutdownHook"));
9387
}
9488

9589
@Override

‎spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatEmbeddedWebappClassLoader.java

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ private Class<?> findExistingLoadedClass(String name) {
8282
}
8383

8484
private Class<?> doLoadClass(String name) throws ClassNotFoundException {
85-
checkPackageAccess(name);
8685
if ((this.delegate || filter(name, true))) {
8786
Class<?> result = loadFromParent(name);
8887
return (result != null) ? result : findClassIgnoringNotFound(name);
@@ -127,15 +126,4 @@ private Class<?> findClassIgnoringNotFound(String name) {
127126
}
128127
}
129128

130-
private void checkPackageAccess(String name) throws ClassNotFoundException {
131-
if (this.securityManager != null && name.lastIndexOf('.') >= 0) {
132-
try {
133-
this.securityManager.checkPackageAccess(name.substring(0, name.lastIndexOf('.')));
134-
}
135-
catch (SecurityException ex) {
136-
throw new ClassNotFoundException("Security Violation, attempt to use Restricted Class: " + name, ex);
137-
}
138-
}
139-
}
140-
141129
}

0 commit comments

Comments
 (0)