org.mozilla.javascript.SecurityController Maven / Gradle / Ivy
Show all versions of rhino-runtime Show documentation
/* -*- Mode: java; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
// API class
package org.mozilla.javascript;
/**
* This class describes the support needed to implement security.
*
* Three main pieces of functionality are required to implement
* security for JavaScript. First, it must be possible to define
* classes with an associated security domain. (This security
* domain may be any object incorporating notion of access
* restrictions that has meaning to an embedding; for a client-side
* JavaScript embedding this would typically be
* java.security.ProtectionDomain or similar object depending on an
* origin URL and/or a digital certificate.)
* Next it must be possible to get a security domain object that
* allows a particular action only if all security domains
* associated with code on the current Java stack allows it. And
* finally, it must be possible to execute script code with
* associated security domain injected into Java stack.
*
* These three pieces of functionality are encapsulated in the
* SecurityController class.
*
* @see org.mozilla.javascript.Context#setSecurityController(SecurityController)
* @see java.lang.ClassLoader
* @since 1.5 Release 4
*/
public abstract class SecurityController
{
private static SecurityController global;
// The method must NOT be public or protected
static SecurityController global()
{
return global;
}
/**
* Check if global {@link SecurityController} was already installed.
* @see #initGlobal(SecurityController controller)
*/
public static boolean hasGlobal()
{
return global != null;
}
/**
* Initialize global controller that will be used for all
* security-related operations. The global controller takes precedence
* over already installed {@link Context}-specific controllers and cause
* any subsequent call to
* {@link Context#setSecurityController(SecurityController)}
* to throw an exception.
*
* The method can only be called once.
*
* @see #hasGlobal()
*/
public static void initGlobal(SecurityController controller)
{
if (controller == null) throw new IllegalArgumentException();
if (global != null) {
throw new SecurityException("Cannot overwrite already installed global SecurityController");
}
global = controller;
}
/**
* Get class loader-like object that can be used
* to define classes with the given security context.
* @param parentLoader parent class loader to delegate search for classes
* not defined by the class loader itself
* @param securityDomain some object specifying the security
* context of the code that is defined by the returned class loader.
*/
public abstract GeneratedClassLoader createClassLoader(
ClassLoader parentLoader, Object securityDomain);
/**
* Create {@link GeneratedClassLoader} with restrictions imposed by
* staticDomain and all current stack frames.
* The method uses the SecurityController instance associated with the
* current {@link Context} to construct proper dynamic domain and create
* corresponding class loader.
*
* If no SecurityController is associated with the current {@link Context} ,
* the method calls {@link Context#createClassLoader(ClassLoader parent)}.
*
* @param parent parent class loader. If null,
* {@link Context#getApplicationClassLoader()} will be used.
* @param staticDomain static security domain.
*/
public static GeneratedClassLoader createLoader(
ClassLoader parent, Object staticDomain)
{
Context cx = Context.getContext();
if (parent == null) {
parent = cx.getApplicationClassLoader();
}
SecurityController sc = cx.getSecurityController();
GeneratedClassLoader loader;
if (sc == null) {
loader = cx.createClassLoader(parent);
} else {
Object dynamicDomain = sc.getDynamicSecurityDomain(staticDomain);
loader = sc.createClassLoader(parent, dynamicDomain);
}
return loader;
}
public static Class getStaticSecurityDomainClass() {
SecurityController sc = Context.getContext().getSecurityController();
return sc == null ? null : sc.getStaticSecurityDomainClassInternal();
}
public Class getStaticSecurityDomainClassInternal()
{
return null;
}
/**
* Get dynamic security domain that allows an action only if it is allowed
* by the current Java stack and securityDomain. If
* securityDomain is null, return domain representing permissions
* allowed by the current stack.
*/
public abstract Object getDynamicSecurityDomain(Object securityDomain);
/**
* Call {@link
* Callable#call(Context cx, Scriptable scope, Scriptable thisObj,
* Object[] args)}
* of callable under restricted security domain where an action is
* allowed only if it is allowed according to the Java stack on the
* moment of the execWithDomain call and securityDomain.
* Any call to {@link #getDynamicSecurityDomain(Object)} during
* execution of callable.call(cx, scope, thisObj, args)
* should return a domain incorporate restrictions imposed by
* securityDomain and Java stack on the moment of callWithDomain
* invocation.
*
* The method should always be overridden, it is not declared abstract
* for compatibility reasons.
*/
public Object callWithDomain(Object securityDomain, Context cx,
final Callable callable, Scriptable scope,
final Scriptable thisObj, final Object[] args)
{
return execWithDomain(cx, scope, new Script()
{
@Override
public Object exec(Context cx, Scriptable scope)
{
return callable.call(cx, scope, thisObj, args);
}
}, securityDomain);
}
/**
* @deprecated The application should not override this method and instead
* override
* {@link #callWithDomain(Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, Object[] args)}.
*/
@Deprecated
public Object execWithDomain(Context cx, Scriptable scope,
Script script, Object securityDomain)
{
throw new IllegalStateException("callWithDomain should be overridden");
}
}