Uploaded image for project: 'Application Server 7'
  1. Application Server 7
  2. AS7-5718

Client deserialising objects using wrong classloader

XMLWordPrintable

    • Hide

      1) Deploy two applications which both make JNDI lookups to a remote server, looking up an object which is defined in their classloader. Do not close the Context() they use.
      2) Cause both applications to do JNDI lookup from the same thread

      Example: https://github.com/doctau/jboss-as/commit/49d4e69020b0926cf1e1a0d94d6528440baaf7f8

      Show
      1) Deploy two applications which both make JNDI lookups to a remote server, looking up an object which is defined in their classloader. Do not close the Context() they use. 2) Cause both applications to do JNDI lookup from the same thread Example: https://github.com/doctau/jboss-as/commit/49d4e69020b0926cf1e1a0d94d6528440baaf7f8
    • Hide

      Ensure that close() is called on all remote contexts.

      Show
      Ensure that close() is called on all remote contexts.

      The commands in org.jboss.naming.remote.protocol.v1.Protocol deserialize objects using the Unmarshaller from ReadUtil. That does not explicitly set a ClassResolver, so it defaults to using the TCCL. Since the handle*Message methods are run in a thread pool, the TCCL could be set to anything, so the commands need to ensure that the correct classloader (presumably the one calling the Context methods) is used.

              rhn-support-jlivings James Livingston (Inactive)
              rhn-support-jlivings James Livingston (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: