212 lines
8.1 KiB
Java
212 lines
8.1 KiB
Java
/* -*- Mode: java; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
|
|
*
|
|
* ***** BEGIN LICENSE BLOCK *****
|
|
* Version: MPL 1.1/GPL 2.0
|
|
*
|
|
* The contents of this file are subject to the Mozilla Public License Version
|
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
|
* the License. You may obtain a copy of the License at
|
|
* http://www.mozilla.org/MPL/
|
|
*
|
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
|
* for the specific language governing rights and limitations under the
|
|
* License.
|
|
*
|
|
* The Original Code is Rhino code, released
|
|
* May 6, 1999.
|
|
*
|
|
* The Initial Developer of the Original Code is
|
|
* Netscape Communications Corporation.
|
|
* Portions created by the Initial Developer are Copyright (C) 1997-1999
|
|
* the Initial Developer. All Rights Reserved.
|
|
*
|
|
* Contributor(s):
|
|
* Norris Boyd
|
|
* Igor Bukanov
|
|
*
|
|
* Alternatively, the contents of this file may be used under the terms of
|
|
* the GNU General Public License Version 2 or later (the "GPL"), in which
|
|
* case the provisions of the GPL are applicable instead of those above. If
|
|
* you wish to allow use of your version of this file only under the terms of
|
|
* the GPL and not to allow others to use your version of this file under the
|
|
* MPL, indicate your decision by deleting the provisions above and replacing
|
|
* them with the notice and other provisions required by the GPL. If you do
|
|
* not delete the provisions above, a recipient may use your version of this
|
|
* file under either the MPL or the GPL.
|
|
*
|
|
* ***** END LICENSE BLOCK ***** */
|
|
|
|
// API class
|
|
|
|
package org.mozilla.javascript;
|
|
|
|
/**
|
|
* This class describes the support needed to implement security.
|
|
* <p>
|
|
* Three main pieces of functionality are required to implement
|
|
* security for JavaScript. First, it must be possible to define
|
|
* classes with an associated security domain. (This security
|
|
* domain may be any object incorporating notion of access
|
|
* restrictions that has meaning to an embedding; for a client-side
|
|
* JavaScript embedding this would typically be
|
|
* java.security.ProtectionDomain or similar object depending on an
|
|
* origin URL and/or a digital certificate.)
|
|
* Next it must be possible to get a security domain object that
|
|
* allows a particular action only if all security domains
|
|
* associated with code on the current Java stack allows it. And
|
|
* finally, it must be possible to execute script code with
|
|
* associated security domain injected into Java stack.
|
|
* <p>
|
|
* These three pieces of functionality are encapsulated in the
|
|
* SecurityController class.
|
|
*
|
|
* @see org.mozilla.javascript.Context#setSecurityController(SecurityController)
|
|
* @see java.lang.ClassLoader
|
|
* @since 1.5 Release 4
|
|
*/
|
|
public abstract class SecurityController
|
|
{
|
|
private static SecurityController global;
|
|
|
|
// The method must NOT be public or protected
|
|
static SecurityController global()
|
|
{
|
|
return global;
|
|
}
|
|
|
|
/**
|
|
* Check if global {@link SecurityController} was already installed.
|
|
* @see #initGlobal(SecurityController controller)
|
|
*/
|
|
public static boolean hasGlobal()
|
|
{
|
|
return global != null;
|
|
}
|
|
|
|
/**
|
|
* Initialize global controller that will be used for all
|
|
* security-related operations. The global controller takes precedence
|
|
* over already installed {@link Context}-specific controllers and cause
|
|
* any subsequent call to
|
|
* {@link Context#setSecurityController(SecurityController)}
|
|
* to throw an exception.
|
|
* <p>
|
|
* The method can only be called once.
|
|
*
|
|
* @see #hasGlobal()
|
|
*/
|
|
public static void initGlobal(SecurityController controller)
|
|
{
|
|
if (controller == null) throw new IllegalArgumentException();
|
|
if (global != null) {
|
|
throw new SecurityException("Cannot overwrite already installed global SecurityController");
|
|
}
|
|
global = controller;
|
|
}
|
|
|
|
/**
|
|
* Get class loader-like object that can be used
|
|
* to define classes with the given security context.
|
|
* @param parentLoader parent class loader to delegate search for classes
|
|
* not defined by the class loader itself
|
|
* @param securityDomain some object specifying the security
|
|
* context of the code that is defined by the returned class loader.
|
|
*/
|
|
public abstract GeneratedClassLoader createClassLoader(
|
|
ClassLoader parentLoader, Object securityDomain);
|
|
|
|
/**
|
|
* Create {@link GeneratedClassLoader} with restrictions imposed by
|
|
* staticDomain and all current stack frames.
|
|
* The method uses the SecurityController instance associated with the
|
|
* current {@link Context} to construct proper dynamic domain and create
|
|
* corresponding class loader.
|
|
* <par>
|
|
* If no SecurityController is associated with the current {@link Context} ,
|
|
* the method calls {@link Context#createClassLoader(ClassLoader parent)}.
|
|
*
|
|
* @param parent parent class loader. If null,
|
|
* {@link Context#getApplicationClassLoader()} will be used.
|
|
* @param staticDomain static security domain.
|
|
*/
|
|
public static GeneratedClassLoader createLoader(
|
|
ClassLoader parent, Object staticDomain)
|
|
{
|
|
Context cx = Context.getContext();
|
|
if (parent == null) {
|
|
parent = cx.getApplicationClassLoader();
|
|
}
|
|
SecurityController sc = cx.getSecurityController();
|
|
GeneratedClassLoader loader;
|
|
if (sc == null) {
|
|
loader = cx.createClassLoader(parent);
|
|
} else {
|
|
Object dynamicDomain = sc.getDynamicSecurityDomain(staticDomain);
|
|
loader = sc.createClassLoader(parent, dynamicDomain);
|
|
}
|
|
return loader;
|
|
}
|
|
|
|
public static Class<?> getStaticSecurityDomainClass() {
|
|
SecurityController sc = Context.getContext().getSecurityController();
|
|
return sc == null ? null : sc.getStaticSecurityDomainClassInternal();
|
|
}
|
|
|
|
public Class<?> getStaticSecurityDomainClassInternal()
|
|
{
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Get dynamic security domain that allows an action only if it is allowed
|
|
* by the current Java stack and <i>securityDomain</i>. If
|
|
* <i>securityDomain</i> is null, return domain representing permissions
|
|
* allowed by the current stack.
|
|
*/
|
|
public abstract Object getDynamicSecurityDomain(Object securityDomain);
|
|
|
|
/**
|
|
* Call {@link
|
|
* Callable#call(Context cx, Scriptable scope, Scriptable thisObj,
|
|
* Object[] args)}
|
|
* of <i>callable</i> under restricted security domain where an action is
|
|
* allowed only if it is allowed according to the Java stack on the
|
|
* moment of the <i>execWithDomain</i> call and <i>securityDomain</i>.
|
|
* Any call to {@link #getDynamicSecurityDomain(Object)} during
|
|
* execution of <tt>callable.call(cx, scope, thisObj, args)</tt>
|
|
* should return a domain incorporate restrictions imposed by
|
|
* <i>securityDomain</i> and Java stack on the moment of callWithDomain
|
|
* invocation.
|
|
* <p>
|
|
* The method should always be overridden, it is not declared abstract
|
|
* for compatibility reasons.
|
|
*/
|
|
public Object callWithDomain(Object securityDomain, Context cx,
|
|
final Callable callable, Scriptable scope,
|
|
final Scriptable thisObj, final Object[] args)
|
|
{
|
|
return execWithDomain(cx, scope, new Script()
|
|
{
|
|
public Object exec(Context cx, Scriptable scope)
|
|
{
|
|
return callable.call(cx, scope, thisObj, args);
|
|
}
|
|
|
|
}, securityDomain);
|
|
}
|
|
|
|
/**
|
|
* @deprecated The application should not override this method and instead
|
|
* override
|
|
* {@link #callWithDomain(Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, Object[] args)}.
|
|
*/
|
|
public Object execWithDomain(Context cx, Scriptable scope,
|
|
Script script, Object securityDomain)
|
|
{
|
|
throw new IllegalStateException("callWithDomain should be overridden");
|
|
}
|
|
|
|
|
|
}
|