-
Notifications
You must be signed in to change notification settings - Fork 35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove SecurityManager #248
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -22,7 +22,6 @@ | |
import org.apache.maven.plugins.annotations.Mojo; | ||
import org.apache.maven.plugins.annotations.Parameter; | ||
import org.apache.maven.plugins.annotations.ResolutionScope; | ||
import org.codehaus.gmavenplus.util.NoExitSecurityManager; | ||
|
||
import java.io.File; | ||
import java.lang.reflect.InvocationTargetException; | ||
|
@@ -86,12 +85,7 @@ public void execute() throws MojoExecutionException, MojoFailureException { | |
} | ||
|
||
if (groovyVersionSupportsAction()) { | ||
final SecurityManager sm = System.getSecurityManager(); | ||
try { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(new NoExitSecurityManager()); | ||
} | ||
Comment on lines
-91
to
-93
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Print a warning in case this is |
||
|
||
// get classes we need with reflection | ||
Class<?> consoleClass; | ||
try { | ||
|
@@ -127,10 +121,6 @@ public void execute() throws MojoExecutionException, MojoFailureException { | |
throw new MojoExecutionException("Unable to access a method on a Groovy class from classpath.", e); | ||
} catch (InstantiationException e) { | ||
throw new MojoExecutionException("Error occurred while instantiating a Groovy class from classpath.", e); | ||
} finally { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(sm); | ||
} | ||
} | ||
} else { | ||
getLog().error("Your Groovy version (" + classWrangler.getGroovyVersionString() + ") doesn't support running a console. The minimum version of Groovy required is " + minGroovyVersion + ". Skipping console startup."); | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -23,7 +23,6 @@ | |
import org.apache.maven.plugins.annotations.ResolutionScope; | ||
import org.codehaus.gmavenplus.model.internal.Version; | ||
import org.codehaus.gmavenplus.util.FileUtils; | ||
import org.codehaus.gmavenplus.util.NoExitSecurityManager; | ||
|
||
import java.io.BufferedReader; | ||
import java.io.File; | ||
|
@@ -137,12 +136,7 @@ protected synchronized void doExecute() throws MojoExecutionException { | |
} | ||
|
||
if (groovyVersionSupportsAction()) { | ||
final SecurityManager sm = System.getSecurityManager(); | ||
try { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(new NoExitSecurityManager()); | ||
} | ||
Comment on lines
-142
to
-144
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same, keep var and print warning (to be removed in…) |
||
|
||
// get classes we need with reflection | ||
Class<?> groovyShellClass = classWrangler.getClass("groovy.lang.GroovyShell"); | ||
|
||
|
@@ -159,10 +153,6 @@ protected synchronized void doExecute() throws MojoExecutionException { | |
throw new MojoExecutionException("Error occurred while instantiating a Groovy class from classpath.", e); | ||
} catch (IllegalAccessException e) { | ||
throw new MojoExecutionException("Unable to access a method on a Groovy class from classpath.", e); | ||
} finally { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(sm); | ||
} | ||
} | ||
} else { | ||
getLog().error("Your Groovy version (" + classWrangler.getGroovyVersionString() + ") doesn't support script execution. The minimum version of Groovy required is " + minGroovyVersion + ". Skipping script execution."); | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -22,7 +22,6 @@ | |
import org.apache.maven.plugins.annotations.Parameter; | ||
import org.apache.maven.plugins.annotations.ResolutionScope; | ||
import org.codehaus.gmavenplus.model.internal.Version; | ||
import org.codehaus.gmavenplus.util.NoExitSecurityManager; | ||
|
||
import java.lang.reflect.InvocationTargetException; | ||
import java.lang.reflect.Method; | ||
|
@@ -91,12 +90,7 @@ public void execute() throws MojoExecutionException { | |
} | ||
|
||
if (groovyVersionSupportsAction()) { | ||
final SecurityManager sm = System.getSecurityManager(); | ||
try { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(new NoExitSecurityManager()); | ||
} | ||
Comment on lines
-96
to
-98
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. As above |
||
|
||
// get classes we need with reflection | ||
Class<?> shellClass = classWrangler.getClass(groovyAtLeast(GROOVY_4_0_0_ALPHA1) ? "org.apache.groovy.groovysh.Groovysh" : "org.codehaus.groovy.tools.shell.Groovysh"); | ||
Class<?> bindingClass = classWrangler.getClass("groovy.lang.Binding"); | ||
|
@@ -121,10 +115,6 @@ public void execute() throws MojoExecutionException { | |
throw new MojoExecutionException("Unable to access a method on a Groovy class from classpath.", e); | ||
} catch (InstantiationException e) { | ||
throw new MojoExecutionException("Error occurred while instantiating a Groovy class from classpath.", e); | ||
} finally { | ||
if (!allowSystemExits) { | ||
System.setSecurityManager(sm); | ||
} | ||
} | ||
} else { | ||
getLog().error("Your Groovy version (" + classWrangler.getGroovyVersionString() + ") doesn't support running a shell. The minimum version of Groovy required is " + minGroovyVersion + ". Skipping shell startup."); | ||
|
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As this would be a breaking change, keep it for a while and just print a warning for now. This way, users can fix their scripts.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yea, that's why I hadn't merged this -- Java isn't forcing me to yet.
Another option here might be to wrap the usage in
if (Version.parseFromString(System.getProperty("java.version")).compareTo(new Version(24)) >=1)
and print a warning if using a newer Java version that won't support it and ignore the option in that case. And in the meantime, print a warning and deprecate the parameter.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure when they're planning on removing this (I used 24 as an example). I don't think they've decided when that will be (or at least I can't find any documentation about it).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, it gets removed. The warning is there since 17 or 18.
Docs: https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/SecurityManager.html
There's more
https://openjdk.org/jeps/411
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
But that would still print a ClassNotFoundException on 24 or so. Unless:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking of using reflection
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd rather put that code into its own class.
Then, for Java 21+, create a Multi Release Jar which implements this as a no-op.
Easier to maintain, faster than reflection.
But still, why not start with a warning? 🤷🏻♂️ Ship early, ship often.