Package org.htmlunit.corejs.javascript
Class PolicySecurityController
- java.lang.Object
-
- org.htmlunit.corejs.javascript.SecurityController
-
- org.htmlunit.corejs.javascript.PolicySecurityController
-
public class PolicySecurityController extends SecurityController
A security controller relying on JavaPolicy
in effect. When you use this security controller, your securityDomain objects must be instances ofCodeSource
representing the location from where you load your scripts. Any Java policy "grant" statements matching the URL and certificate in code sources will apply to the scripts. If you specify any certificates within yourCodeSource
objects, it is your responsibility to verify (or not) that the script source files are signed in whatever implementation-specific way you're using.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description private static class
PolicySecurityController.Loader
static class
PolicySecurityController.SecureCaller
-
Field Summary
Fields Modifier and Type Field Description private static java.util.Map<java.security.CodeSource,java.util.Map<java.lang.ClassLoader,java.lang.ref.SoftReference<PolicySecurityController.SecureCaller>>>
callers
private static byte[]
secureCallerImplBytecode
-
Constructor Summary
Constructors Constructor Description PolicySecurityController()
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description java.lang.Object
callWithDomain(java.lang.Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, java.lang.Object[] args)
CallCallable.call(Context cx, Scriptable scope, Scriptable thisObj, Object[] args)
of callable under restricted security domain where an action is allowed only if it is allowed according to the Java stack on the moment of the execWithDomain call and securityDomain.GeneratedClassLoader
createClassLoader(java.lang.ClassLoader parent, java.lang.Object securityDomain)
Get class loader-like object that can be used to define classes with the given security context.java.lang.Object
getDynamicSecurityDomain(java.lang.Object securityDomain)
Get dynamic security domain that allows an action only if it is allowed by the current Java stack and securityDomain.java.lang.Class<?>
getStaticSecurityDomainClassInternal()
private static byte[]
loadBytecode()
-
Methods inherited from class org.htmlunit.corejs.javascript.SecurityController
createLoader, execWithDomain, getStaticSecurityDomainClass, global, hasGlobal, initGlobal
-
-
-
-
Field Detail
-
secureCallerImplBytecode
private static final byte[] secureCallerImplBytecode
-
callers
private static final java.util.Map<java.security.CodeSource,java.util.Map<java.lang.ClassLoader,java.lang.ref.SoftReference<PolicySecurityController.SecureCaller>>> callers
-
-
Method Detail
-
getStaticSecurityDomainClassInternal
public java.lang.Class<?> getStaticSecurityDomainClassInternal()
- Overrides:
getStaticSecurityDomainClassInternal
in classSecurityController
-
createClassLoader
public GeneratedClassLoader createClassLoader(java.lang.ClassLoader parent, java.lang.Object securityDomain)
Description copied from class:SecurityController
Get class loader-like object that can be used to define classes with the given security context.- Specified by:
createClassLoader
in classSecurityController
- Parameters:
parent
- parent class loader to delegate search for classes not defined by the class loader itselfsecurityDomain
- some object specifying the security context of the code that is defined by the returned class loader.
-
getDynamicSecurityDomain
public java.lang.Object getDynamicSecurityDomain(java.lang.Object securityDomain)
Description copied from class:SecurityController
Get dynamic security domain that allows an action only if it is allowed by the current Java stack and securityDomain. If securityDomain is null, return domain representing permissions allowed by the current stack.- Specified by:
getDynamicSecurityDomain
in classSecurityController
-
callWithDomain
public java.lang.Object callWithDomain(java.lang.Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, java.lang.Object[] args)
Description copied from class:SecurityController
CallCallable.call(Context cx, Scriptable scope, Scriptable thisObj, Object[] args)
of callable under restricted security domain where an action is allowed only if it is allowed according to the Java stack on the moment of the execWithDomain call and securityDomain. Any call toSecurityController.getDynamicSecurityDomain(Object)
during execution ofcallable.call(cx, scope, thisObj, args)
should return a domain incorporate restrictions imposed by securityDomain and Java stack on the moment of callWithDomain invocation.The method should always be overridden, it is not declared abstract for compatibility reasons.
- Overrides:
callWithDomain
in classSecurityController
-
loadBytecode
private static byte[] loadBytecode()
-
-