Friday, February 07, 2003

Turn that security manager on! Most Java developers I know download and execute applications all the time, without using a SecurityManager. (Admit it, you have tried various open source projects.) The madness stops for me today. Whenever I download some Java app, I am going to start with SecurityManager on, and policy empty. Then, it is simple to read exception traces (or turn on -Djava.security.debug) to figure out what permissions are needed. For example, it took me all of five minutes to produce this policy file for jing: /* assumes that files are all in the current directory */ grant /* codeBase "jing.jar" */ { permission java.util.PropertyPermission "user.dir", "read"; permission java.io.FilePermission "*", "read"; }; Of course, building these files can be laborious. Maybe somebody should start a repository with sample policy files for key Java applications... 1:26:16 AM    comment []

Classes are not files This is a hack: private File getDir() { return new File( getClass().getResource("/" + getClass().getName().replace('.','/') + ".class").getFile() ).getParentFile(); } } The assumption that classes are files negates the power of Java's class loaders. I'll grant that in a unit test harness this may not be as big a deal as it would be in shipping code, but it still makes me uncomfortable. 12:46:19 AM    comment []