This is version . It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]
TitleCode signing is unnecessary
Date25-Feb-2006 01:04:17 EET
Version2.3
Submitter89.55.177.112
Bug criticalityLightBug
Browser version
Bug statusNotReallyBug
PageProvider used
Servlet ContainerTomcat 5.5
Operating SystemWin32, Linux
URL
Java version5.0

JSPWiki uses jspwiki.policy entries like ({) grant signedBy "jspwiki" principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" (})

The signedBy is unnecessary, it suffices to grant to principals.

I deleted all signedBy "jspwiki", the security code still works. I tested Sun JDK 5.0 with XP and Linux.

The signing makes development unnecessarily difficult.


This is not a bug, because code-signing is needed to support certain deployment scenarios. This is perhaps a slight impediment to development, but I think we've done the best we can to make code-signing easy. The Ant scripts will auto-generate a key for you (with sensible defaults) whenever you build JSPWiki from scratch. So I think the comment "unnecessarily difficult" is a little harsh.

As for why we need to do code-signing, it's NOT necessary in the default case where you drop a WAR into a servlet container and use JSPWiki as a single, stand-alone wiki. But for multi-wiki deployments in the same container, or for those cases where the implementer wishes to specify an external security policy file, then we need our code to be signed. Specifically, it has to do with the way Permission classes are loaded and evaluated by the Java access control classes. JSPWiki makes extensive use of custom Permission types (PagePermission, WikiPermission and AllPermission).

Here's an excerpt from the definitive book, Inside Java 2 Platform Security, 2nd Edition, by Li Gong, that explains why this is so:

Many Permission classes referenced by the policy configuration exist locally. That is, those classes can be discovered by the Policy provider's defining class loader or another loader it delegates to, such as the bootstrap class loader. Objects for such permissions can be instantiated during Policy initialization. For example, it is always possible to instantiate a java.io.FilePermission, as the FilePermission class is bound on the bootstrap class path.

However, [it is possible that] when the Policy object is constructed, the code that implements a particular Permission class has yet to be loaded or is not available for loading. For example, a referenced Permission class might be in a JAR file that will eventually be downloaded. In this case, the Permission has yet to be defined within the Java runtime environment. For such a class, an UnresolvedPermission object is instantiated instead, as a placeholder that contains information about the permission... Unresolved permissions of a particular type must be resolved before an access control decision can be made about a permission of the actual type... To resolve an UnresolvedPermission, the policy decision point must locate and instantiate the appropriate permission class type...

A few methods... in the UnresolvedPermission class are

public UnresolvedPermission(String type, String name, 
String actions, java.security.cert.Certificate certs[]);

public boolean implies(Permission p);

public boolean equals(Object obj); 

Note that the constructor takes an array of certificates, which can be used to verify the signatures on the permission class. Remember that UnresolvedPermissions enable the deferred loading of permission classes so that a given permission class need not be defined until necessary. The very nature of such permission classes suggests that a more rigorous mechanism is required to ensure their authenticity. By signing a given permission class and specifying the signing requirement in the security policy, we have a foundation that can be used to assure us that the permission class respects the intentions of the root class java.security.Permission and that the implementation is not malicious. Of course, this assurance depends on the trust conveyed by the signature keys used to sign the class. However, without this mechanism, it would be up to the application to make this trust decision, which would be difficult, if not impossible, for the application to do. [emphasis mine]

Thus -- the logic works like this...

If the classes containing our custom permissions are all loaded before the Policy is set, then we don't need to sign them. For stand-alone, out-of-the-box JSPWiki implementations that do not also specify an external policy file via the java.security.policy system property at startup, all classes will be loaded before JSPWiki sets its custom policy.

However, it is not safe to assume that all environments work this way. In some (mine, for instance), the admin will wish to set the policy file manually. In this case, the JSPWiki Permission classes will not be available to the Java Policy object at JVM startup. Thus, they are instantiated initially as UnresolvedPermission instances. Therefore, we must have our JAR signed in order for them to become "resolved."

P.S. Li Gong's book is outstanding, by the way, and I recommend it to anyone who wishes to explore the innards of Java security. Took me several read-throughs to really grok it, but it was well worth the effort.

-- Andrew Jaquith, 29 March 2006

http://dvd.1golod.org/ken-park-dvd-uncensored.html ken park dvd uncensored http://dvd.1golod.org/kawasaki-portable-dvd-player.html kawasaki portable dvd player http://dvd.1golod.org/kawasaki-9inch-dvd-pvs10921.html kawasaki 9inch dvd pvs10921 http://dvd.1golod.org/kacey-dvd.html kacey dvd http://dvd.1golod.org/jvc-dvd-players.html jvc dvd players http://dvd.1golod.org/jvc-dvd-mp3.html jvc dvd mp3 http://dvd.1golod.org/jvc-combo-dvd-vcr.html jvc combo dvd vcr http://dvd.1golod.org/joueurs-portatifs-initiaux-de-dvd-en-vente.html joueurs portatifs initiaux de dvd en vente http://dvd.1golod.org/joueur-libre-de-logiciel-de-dvd.html joueur libre de logiciel de dvd http://dvd.1golod.org/joueur-de-dvd-de-l-audiovox-d1800-portatif.html joueur de dvd de l audiovox d1800 portatif http://dvd.1golod.org/joueur-de-dvd-d-orbite.html joueur de dvd d orbite http://dvd.1golod.org/john-doe-the-series-dvd.html john doe the series dvd http://dvd.1golod.org/johannes-weidenmueller-dvd.html johannes weidenmueller dvd http://dvd.1golod.org/jeu-de-secours-ps2-r-de-dvd.html jeu de secours ps2 r de dvd http://dvd.1golod.org/japanese-cooking-dvd.html japanese cooking dvd http://dvd.1golod.org/janq-dvd-discs.html janq dvd discs http://dvd.1golod.org/izakaya-yuurei-dvd.html izakaya yuurei dvd http://dvd.1golod.org/itunes-to-dvd.html itunes to dvd http://dvd.1golod.org/ionics-ems-dvd-drive.html ionics ems dvd drive http://dvd.1golod.org/interviews-with-bob-dvd.html interviews with bob dvd http://dvd.1golod.org/international-on98p-dvd-player.html international on98p dvd player http://dvd.1golod.org/internal-dvd-drive.html internal dvd drive http://dvd.1golod.org/internal-dvd-burner.html internal dvd burner http://dvd.1golod.org/instruction-manual-for-ch-dvd-320.html instruction manual for ch dvd 320 http://dvd.1golod.org/install-osx-tiger-without-dvd-drive.html install osx tiger without dvd drive http://dvd.1golod.org/install-configure-dvd-drives.html install configure dvd drives http://dvd.1golod.org/inspector-alleyn-mysteries-dvd-region-2.html inspector alleyn mysteries dvd region 2 http://dvd.1golod.org/innovatek-dvd-players-price.html innovatek dvd players price http://dvd.1golod.org/initial-dvd-dvd5820.html initial dvd dvd5820 http://dvd.1golod.org/in-search-of-on-dvd.html in search of on dvd http://dvd.1golod.org/imtoo-dvd-to-mp4-converter-serial-number.html imtoo dvd to mp4 converter serial number http://dvd.1golod.org/imtoo-dvd-to-mp4-converter-keygen.html imtoo dvd to mp4 converter keygen http://dvd.1golod.org/imtoo-dvd-to-3gp-suite-crack.html imtoo dvd to 3gp suite crack http://dvd.1golod.org/imtoo-dvd-ripper-4.html imtoo dvd ripper 4 http://dvd.1golod.org/imtoo-dvd-converter.html imtoo dvd converter http://dvd.1golod.org/impressionen-le-dvd-d-escompte-de-wasser-d-unter.html impressionen le dvd d escompte de wasser d unter http://dvd.1golod.org/imagemixer-dvd-authoring-software.html imagemixer dvd authoring software http://dvd.1golod.org/if-----film--malcom-mcdowel--dvd.html if film malcom mcdowel dvd http://dvd.1golod.org/i-need-to-convert-a-movie-maker-file-to-a-dvd-file.html i need to convert a movie maker file to a dvd file http://dvd.1golod.org/i-need-to-conver-a-movie-maker-file-to-a-dvd-file.html i need to conver a movie maker file to a dvd file http://dvd.1golod.org/i-love-lucy-dvd.html i love lucy dvd http://dvd.1golod.org/hp-dvd-630e-total-life.html hp dvd 630e total life http://dvd.1golod.org/hp-dvd-630e.html hp dvd 630e http://dvd.1golod.org/how-to-use-windows-recovery-dvd.html how to use windows recovery dvd http://dvd.1golod.org/how-to-transfer-8mm-to-dvd.html how to transfer 8mm to dvd http://dvd.1golod.org/how-to-tell-dvd-rom.html how to tell dvd rom http://dvd.1golod.org/how-to-rip-dvd-to-ipod.html how to rip dvd to ipod http://dvd.1golod.org/how-to-rip-audio-from-a-dvd.html how to rip audio from a dvd http://dvd.1golod.org/how-to-retrieve-cprx-copied-dvd.html how to retrieve cprx copied dvd http://dvd.1golod.org/how-to-record-to-dvd-hdd-freeview.html how to record to dvd hdd freeview http://dvd.1golod.org/how-to-make-a-bootable-dvd.html how to make a bootable dvd http://dvd.1golod.org/how-to-made-dvd-with-menu.html how to made dvd with menu http://dvd.1golod.org/how-to-install-a-mobile-dvd-system.html how to install a mobile dvd system http://dvd.1golod.org/how-to-install-a-dvd-drive-into-a-xp-computer.html how to install a dvd drive into a xp computer http://dvd.1golod.org/how-to-encrypt-dvd.html how to encrypt dvd http://dvd.1golod.org/how-to-drag-and-drop-dvd-rw.html how to drag and drop dvd rw http://dvd.1golod.org/how-to-copy-a-dvd-with-copy-protection.html how to copy a dvd with copy protection http://dvd.1golod.org/how-to-convert-mpg-files-to-dvd-files.html how to convert mpg files to dvd files http://dvd.1golod.org/how-to-connect-two-tv-dvd-player.html how to connect two tv dvd player http://dvd.1golod.org/how-to-connect-tv-dvd-foxtel-video-together.html how to connect tv dvd foxtel video together http://dvd.1golod.org/how-to-clean-dvd-heads.html how to clean dvd heads http://dvd.1golod.org/how-to-change-a-format-on-a-music-dvd.html how to change a format on a music dvd http://dvd.1golod.org/how-to-backup-os-x-dvd-to-cd.html how to backup os x dvd to cd http://dvd.1golod.org/how-put-large-files-on-dvd.html how put large files on dvd http://dvd.1golod.org/how-do-i-copy-a-copy-protected-dvd-.html how do i copy a copy protected dvd http://dvd.1golod.org/how-do-i-burn-vhs-to-dvd-on-computer.html how do i burn vhs to dvd on computer http://dvd.1golod.org/hot-dvd.html hot dvd http://dvd.1golod.org/hostel-dvd-at-walmart.html hostel dvd at walmart http://dvd.1golod.org/hook-up-vcr-to-dvd-player.html hook up vcr to dvd player http://dvd.1golod.org/hook-up-vcr-to-dvd-plater.html hook up vcr to dvd plater http://dvd.1golod.org/hong-kong-adult-dvd.html hong kong adult dvd http://dvd.1golod.org/hon-hai-precision-dvd-dhw-1160.html hon hai precision dvd dhw 1160 http://dvd.1golod.org/homemade-sex-dvd.html homemade sex dvd http://dvd.1golod.org/home-moives-on-dvd.html home moives on dvd http://dvd.1golod.org/hogtie-dvd-bondage.html hogtie dvd bondage http://dvd.1golod.org/hogans-heroes-dvd.html hogans heroes dvd http://dvd.1golod.org/hitachi-dvd-cam.html hitachi dvd cam http://dvd.1golod.org/history-channel-dvd.html history channel dvd http://dvd.1golod.org/high-capacity-dvd-holder.html high capacity dvd holder http://dvd.1golod.org/hercules-10th-anniversary-dvd.html hercules 10th anniversary dvd http://dvd.1golod.org/herbie-fully-loaded-dvd.html herbie fully loaded dvd http://dvd.1golod.org/helios-dvd.html helios dvd http://dvd.1golod.org/heavenly-creatures-dvd.html heavenly creatures dvd http://dvd.1golod.org/heather-lere-dvd.html heather lere dvd http://dvd.1golod.org/heart-of-gold--buy-the-dvd.html heart of gold buy the dvd http://dvd.1golod.org/heart-like-a-wheel-dvd.html heart like a wheel dvd http://dvd.1golod.org/heardrest-screen-dvd-north-england.html heardrest screen dvd north england http://dvd.1golod.org/headrest-dvd-used.html headrest dvd used http://dvd.1golod.org/hd-quality-dvd-player-on-laptop.html hd quality dvd player on laptop http://dvd.1golod.org/hd-dvd-player-wont-play-.html hd dvd player wont play http://dvd.1golod.org/hbo-s-the-wire-3rd-season-on-dvd.html hbo s the wire 3rd season on dvd http://dvd.1golod.org/harvard-man-dvd-used.html harvard man dvd used http://dvd.1golod.org/harry-potter-and-the-sorcerer-stone-dvd.html harry potter and the sorcerer stone dvd http://dvd.1golod.org/harrowhouse-dvd.html harrowhouse dvd http://dvd.1golod.org/hack-dvd-menus-with-toast-7.html hack dvd menus with toast 7 http://dvd.1golod.org/ha-dvd-burner.html ha dvd burner http://dvd.1golod.org/h-i-m--dvd.html h i m dvd http://dvd.1golod.org/gymstick-dvd.html gymstick dvd http://dvd.1golod.org/gt-pro-dvd-storage.html gt pro dvd storage http://dvd.1golod.org/grey-s-anatomy-dvd.html grey s anatomy dvd http://dvd.1golod.org/go-video-portable-dvd-player.html go video portable dvd player http://dvd.1golod.org/glory-road-dvd.html glory road dvd http://dvd.1golod.org/gia-carangi-the-self-destruction-of-gia-dvd.html gia carangi the self destruction of gia dvd http://dvd.1golod.org/get-smart-why-not-on-dvd.html get smart why not on dvd http://dvd.1golod.org/get-smart-tv-show-dvd.html get smart tv show dvd http://dvd.1golod.org/gay-rimming-dvd.html gay rimming dvd http://dvd.1golod.org/gay-dvd-shop-graz-wolfi.html gay dvd shop graz wolfi http://dvd.1golod.org/gateway-200x-dvd-driver.html gateway 200x dvd driver http://dvd.1golod.org/fujitsu-laptop-dvd-drivers.html fujitsu laptop dvd drivers http://dvd.1golod.org/freeware-pc-dvd-player.html freeware pc dvd player http://dvd.1golod.org/freeware-mpeg-to-dvd-converter.html freeware mpeg to dvd converter http://dvd.1golod.org/freeware-dvd-frame-grabber.html freeware dvd frame grabber http://dvd.1golod.org/freeware-dvd-copier.html freeware dvd copier http://dvd.1golod.org/free-windows-video-to-dvd-converter.html free windows video to dvd converter http://dvd.1golod.org/free-windows-media-player-dvd-decoder.html free windows media player dvd decoder http://dvd.1golod.org/free-trial-adult-dvd-rent.html free trial adult dvd rent http://dvd.1golod.org/free-selfformatting-dvd-copiers.html free selfformatting dvd copiers http://dvd.1golod.org/free-r-kelly-porn-dvd-download.html free r kelly porn dvd download http://dvd.1golod.org/free-porn-semen-sippers-dvd-direct.html free porn semen sippers dvd direct http://dvd.1golod.org/free-music-video-dvd.html free music video dvd http://dvd.1golod.org/free-guitat-lesson-video-dvd.html free guitat lesson video dvd http://dvd.1golod.org/free-full-version-dvd-player.html free full version dvd player http://dvd.1golod.org/free-ebook-dvd-cover-creation-software.html free ebook dvd cover creation software http://dvd.1golod.org/free-dvd-x-copy-platinum-download.html free dvd x copy platinum download http://dvd.1golod.org/free-dvd-upgrade.html free dvd upgrade http://dvd.1golod.org/free-dvd-trailers-for-xxx-movies.html free dvd trailers for xxx movies http://dvd.1golod.org/free-dvd-to-avi-convert.html free dvd to avi convert http://dvd.1golod.org/free-dvd-search-engine.html free dvd search engine http://dvd.1golod.org/free-dvd-ripper-mp3.html free dvd ripper mp3 http://dvd.1golod.org/free-dvd-rip-hack.html free dvd rip hack http://dvd.1golod.org/free-dvd-porn.html free dvd porn http://dvd.1golod.org/free-dvd-plug-in-download.html free dvd plug in download http://dvd.1golod.org/free-dvd-player-for-xp.html free dvd player for xp http://dvd.1golod.org/free-dvd-player-for-computer.html free dvd player for computer http://dvd.1golod.org/free-dvd-movie.html free dvd movie http://dvd.1golod.org/free-dvd-decrypt-software.html free dvd decrypt software http://dvd.1golod.org/free-dvd-data-reader.html free dvd data reader http://dvd.1golod.org/free-dvd-burning-programs-download.html free dvd burning programs download http://dvd.1golod.org/free-dvd-burner-crack.html free dvd burner crack http://dvd.1golod.org/free-dvd-backup.html free dvd backup http://dvd.1golod.org/free-downlaod-of-power-dvd-player.html free downlaod of power dvd player http://dvd.1golod.org/free-computer-dvd-player-software.html free computer dvd player software http://dvd.1golod.org/freddy-mercury-dvd.html freddy mercury dvd http://dvd.1golod.org/fox-dvd-sequel.html fox dvd sequel http://dvd.1golod.org/forum-de-xpress-de-copie-du-dvd-x.html forum de xpress de copie du dvd x http://dvd.1golod.org/forum-de-copie-du-dvd-1click.html forum de copie du dvd 1click http://dvd.1golod.org/format-avi-mpg-mpeg-to-dvd-video-files.html format avi mpg mpeg to dvd video files http://dvd.1golod.org/foreign-film-on-dvd.html foreign film on dvd http://dvd.1golod.org/forced-cuckold-dvd.html forced cuckold dvd http://dvd.1golod.org/forced-bisexuality-dvd.html forced bisexuality dvd http://dvd.1golod.org/first-movie-commercially-released-on-dvd.html first movie commercially released on dvd http://dvd.1golod.org/first-dvd-player.html first dvd player http://dvd.1golod.org/firmware-download-region-free-hp-dvd-writer-400c.html firmware download region free hp dvd writer 400c http://dvd.1golod.org/finding-home-dvd.html finding home dvd http://dvd.1golod.org/final-fuck-x-dvd.html final fuck x dvd http://dvd.1golod.org/fedora-core-dvd-download.html fedora core dvd download http://dvd.1golod.org/father-corapi-dvd.html father corapi dvd http://dvd.1golod.org/fastest-dvd-ripping-program.html fastest dvd ripping program http://dvd.1golod.org/family-guy--uncovered-dvd-review.html family guy uncovered dvd review http://dvd.1golod.org/family-feud-dvd.html family feud dvd http://dvd.1golod.org/fahrenheit-game-dvd-image.html fahrenheit game dvd image http://dvd.1golod.org/eye-of-the-beholder-dvd.html eye of the beholder dvd http://dvd.1golod.org/external-dvd---rw-drives.html external dvd rw drives http://dvd.1golod.org/extended-dvd.html extended dvd http://dvd.1golod.org/explain-dvd-types.html explain dvd types

Add new attachment

Only authorized users are allowed to upload new attachments.
« This particular version was published on 17-Jul-2006 11:30 by 211.53.198.25.