}    }     /**     * Creates one of the well-known permissions directly instead of     * via reflection. Keep list short to not penalize non-JDK-defined     * permissions.     */    private static final Permission getKnownInstance(Class claz,        String name, String actions) {        // XXX shorten list to most popular ones?        if (claz.equals(FilePermission.class)) {            return new FilePermission(name, actions);        } else if (claz.equals(SocketPermission.class)) {            return new SocketPermission(name, actions);        } else if (claz.equals(RuntimePermission.class)) {            return new RuntimePermission(name, actions);        } else if (claz.equals(PropertyPermission.class)) {            return new PropertyPermission(name, actions);        } else if (claz.equals(NetPermission.class)) {            return new NetPermission(name, actions);        } else if (claz.equals(AllPermission.class)) {            return SecurityConstants.ALL_PERMISSION;/*        } else if (claz.equals(ReflectPermission.class)) {            return new ReflectPermission(name, actions);        } else if (claz.equals(SecurityPermission.class)) {            return new SecurityPermission(name, actions);        } else if (claz.equals(PrivateCredentialPermission.class)) {            return new PrivateCredentialPermission(name, actions);        } else if (claz.equals(AuthPermission.class)) {            return new AuthPermission(name, actions);        } else if (claz.equals(ServicePermission.class)) {            return new ServicePermission(name, actions);        } else if (claz.equals(DelegationPermission.class)) {            return new DelegationPermission(name, actions);        } else if (claz.equals(SerializablePermission.class)) {            return new SerializablePermission(name, actions);        } else if (claz.equals(AudioPermission.class)) {            return new AudioPermission(name, actions);        } else if (claz.equals(SSLPermission.class)) {            return new SSLPermission(name, actions);        } else if (claz.equals(LoggingPermission.class)) {            return new LoggingPermission(name, actions);        } else if (claz.equals(SQLPermission.class)) {            return new SQLPermission(name, actions);*/        } else {            return null;        }    }     /**     * Fetch all certs associated with this alias.     */    private Certificate[] getCertificates                (KeyStore keyStore, String aliases, PolicyInfo newInfo) {         List<Certificate> vcerts = null;         StringTokenizer st = new StringTokenizer(aliases, ",");        int n = 0;         while (st.hasMoreTokens()) {            String alias = st.nextToken().trim();            n++;            Certificate cert = null;            // See if this alias's cert has already been cached            synchronized (newInfo.aliasMapping) {                cert = (Certificate)newInfo.aliasMapping.get(alias);                 if (cert == null && keyStore != null) {                     try {                        cert = keyStore.getCertificate(alias);                    } catch (KeyStoreException kse) {                        // never happens, because keystore has already been loaded                        // when we call this                    }                    if (cert != null) {                        newInfo.aliasMapping.put(alias, cert);                        newInfo.aliasMapping.put(cert, alias);                    }                }            }             if (cert != null) {                if (vcerts == null)                    vcerts = new ArrayList<Certificate>();                vcerts.add(cert);            }        }         // make sure n == vcerts.size, since we are doing a logical *and*        if (vcerts != null && n == vcerts.size()) {            Certificate[] certs = new Certificate[vcerts.size()];            vcerts.toArray(certs);            return certs;        } else {            return null;        }    }     /**     * Refreshes the policy object by re-reading all the policy files.     */    @Override public void refresh() {        init(url);    }     /**     * Evaluates the the global policy for the permissions granted to     * the ProtectionDomain and tests whether the permission is     * granted.     *     * @param domain the ProtectionDomain to test     * @param permission the Permission object to be tested for implication.     *     * @return true if "permission" is a proper subset of a permission     * granted to this ProtectionDomain.     *     * @see java.security.ProtectionDomain     */    @Override    public boolean implies(ProtectionDomain pd, Permission p) {        PolicyInfo pi = policyInfo.get();        ProtectionDomainCache pdMap = pi.getPdMapping();         PermissionCollection pc = pdMap.get(pd);         if (pc != null) {            return pc.implies(p);        }         pc = getPermissions(pd);        if (pc == null) {            return false;        }         // cache mapping of protection domain to its PermissionCollection        pdMap.put(pd, pc);        return pc.implies(p);    }     /**     * Examines this <code>Policy</code> and returns the permissions granted     * to the specified <code>ProtectionDomain</code>.  This includes     * the permissions currently associated with the domain as well     * as the policy permissions granted to the domain's     * CodeSource, ClassLoader, and Principals.     *     * <p> Note that this <code>Policy</code> implementation has     * special handling for PrivateCredentialPermissions.     * When this method encounters a <code>PrivateCredentialPermission</code>     * which specifies "self" as the <code>Principal</code> class and name,     * it does not add that <code>Permission</code> to the returned     * <code>PermissionCollection</code>.  Instead, it builds     * a new <code>PrivateCredentialPermission</code>     * for each <code>Principal</code> associated with the provided     * <code>Subject</code>.  Each new <code>PrivateCredentialPermission</code>     * contains the same Credential class as specified in the     * originally granted permission, as well as the Class and name     * for the respective <code>Principal</code>.     *     * <p>     *     * @param domain the Permissions granted to this     *          <code>ProtectionDomain</code> are returned.     *     * @return the Permissions granted to the provided     *          <code>ProtectionDomain</code>.     */    @Override    public PermissionCollection getPermissions(ProtectionDomain domain) {        Permissions perms = new Permissions();         if (domain == null)           return perms;         // first get policy perms        getPermissions(perms, domain);         // add static perms        //      - adding static perms after policy perms is necessary        //        to avoid a regression for 4301064        PermissionCollection pc = domain.getPermissions();        if (pc != null) {            synchronized (pc) {                Enumeration<Permission> e = pc.elements();                while (e.hasMoreElements()) {                    perms.add(e.nextElement());                }            }        }         return perms;    }     /**     * Examines this Policy and creates a PermissionCollection object with     * the set of permissions for the specified CodeSource.     *     * @param CodeSource the codesource associated with the caller.     * This encapsulates the original location of the code (where the code     * came from) and the public key(s) of its signer.     *     * @return the set of permissions according to the policy.     */    @Override    public PermissionCollection getPermissions(CodeSource codesource) {        return getPermissions(new Permissions(), codesource);    }     /**     * Examines the global policy and returns the provided Permissions     * object with additional permissions granted to the specified     * ProtectionDomain.     *     * @param perm the Permissions to populate     * @param pd the ProtectionDomain associated with the caller.     *     * @return the set of Permissions according to the policy.     */    private PermissionCollection getPermissions(Permissions perms,                                        ProtectionDomain pd ) {        if (debug != null) {            debug.println("getPermissions:\n\t" + printPD(pd));        }         final CodeSource cs = pd.getCodeSource();        if (cs == null)            return perms;         CodeSource canonCodeSource = AccessController.doPrivileged(            new java.security.PrivilegedAction<CodeSource>(){                public CodeSource run() {                    return canonicalizeCodebase(cs, true);                }            });        return getPermissions(perms, canonCodeSource, pd.getPrincipals());    }     /**     * Examines the global policy and returns the provided Permissions     * object with additional permissions granted to the specified     * CodeSource.     *     * @param permissions the permissions to populate     * @param codesource the codesource associated with the caller.     * This encapsulates the original location of the code (where the code     * came from) and the public key(s) of its signer.     *     * @return the set of permissions according to the policy.     */    private PermissionCollection getPermissions(Permissions perms,                               final CodeSource cs) {         CodeSource canonCodeSource = AccessController.doPrivileged(            new java.security.PrivilegedAction<CodeSource>(){                public CodeSource run() {                    return canonicalizeCodebase(cs, true);                }            });         return getPermissions(perms, canonCodeSource, null);    }     private Permissions getPermissions(Permissions perms,                                       final CodeSource cs,                                       Principal[] principals) {        PolicyInfo pi = policyInfo.get();         for (PolicyEntry entry : pi.policyEntries) {            addPermissions(perms, cs, principals, entry);        }         // Go through policyEntries gotten from identity db; sync required        // because checkForTrustedIdentity (below) might update list        synchronized (pi.identityPolicyEntries) {            for (PolicyEntry entry : pi.identityPolicyEntries) {                addPermissions(perms, cs, principals, entry);            }        }         // now see if any of the keys are trusted ids.        if (!ignoreIdentityScope) {            Certificate certs[] = cs.getCertificates();            if (certs != null) {                for (int k=0; k < certs.length; k++) {                    Object idMap = pi.aliasMapping.get(certs[k]);                    if (idMap == null &&                        checkForTrustedIdentity(certs[k], pi)) {                        // checkForTrustedIdentity added it                        // to the policy for us. next time                        // around we'll find it. This time                        // around we need to add it.                        perms.add(SecurityConstants.ALL_PERMISSION);                    }                }            }        }        return perms;    }     private void addPermissions(Permissions perms,        final CodeSource cs,        Principal[] principals,        final PolicyEntry entry) {         if (debug != null) {            debug.println("evaluate codesources:\n" +                "\tPolicy CodeSource: " + entry.getCodeSource() + "\n" +                "\tActive CodeSource: " + cs);        }         // check to see if the CodeSource implies        Boolean imp = AccessController.doPrivileged            (new PrivilegedAction<Boolean>() {            public Boolean run() {                return new Boolean(entry.getCodeSource().implies(cs));            }        });        if (!imp.booleanValue()) {            if (debug != null) {                debug.println("evaluation (codesource) failed");            }             // CodeSource does not imply - return and try next policy entry            return;        }         // check to see if the Principals imply         List<PolicyParser.PrincipalEntry> entryPs = entry.getPrincipals();        if (debug != null) {            ArrayList<PolicyParser.PrincipalEntry> accPs = new ArrayList<>();            if (principals != null) {                for (int i = 0; i < principals.length; i++) {                    accPs.add(new PolicyParser.PrincipalEntry                                        (principals[i].getClass().getName(),                                        principals[i].getName()));                }            }            debug.println("evaluate principals:\n" +                "\tPolicy Principals: " + entryPs + "\n" +                "\tActive Principals: " + accPs);        }         if (entryPs == null || entryPs.size() == 0) {             // policy entry has no principals -            // add perms regardless of principals in current ACC             addPerms(perms, principals, entry);            if (debug != null) {                debug.println("evaluation (codesource/principals) passed");            }            return;         } else if (principals == null || principals.length == 0) {             // current thread has no principals but this policy entry            // has principals - perms are not added             if (debug != null) {                debug.println("evaluation (principals) failed");            }            return;        }         // current thread has principals and this policy entry        // has principals.  see if policy entry principals match        // principals in current ACC         for (int i = 0; i < entryPs.size(); i++) {            PolicyParser.PrincipalEntry pppe = entryPs.get(i);             // see if principal entry is a PrincipalComparator             try {                Class<?> pClass = Class.forName                                (pppe.principalClass,                                true,                                Thread.currentThread().getContextClassLoader());                 if (!PrincipalComparator.class.isAssignableFrom(pClass)) {                     // common case - dealing with regular Principal class.                    // see if policy entry principal is in current ACC                     if (!checkEntryPs(principals, pppe)) {                        if (debug != null) {                            debug.println("evaluation (principals) failed");                        }                         // policy entry principal not in current ACC -                        // immediately return and go to next policy entry                        return;                    }                 } else {                     // dealing with a PrincipalComparator                     Constructor<?> c = pClass.getConstructor(PARAMS1);                    PrincipalComparator pc = (PrincipalComparator)c.newInstance                                        (new Object[] { pppe.principalName });                     if (debug != null) {                        debug.println("found PrincipalComparator " +                                        pc.getClass().getName());                    }                     // check if the PrincipalComparator                    // implies the current thread's principals                     Set<Principal> pSet = new HashSet<>(principals.length);                    for (int j = 0; j < principals.length; j++) {                        pSet.add(principals[j]);                    }                    Subject subject = new Subject(true,                                                pSet,                                                Collections.EMPTY_SET,                                                Collections.EMPTY_SET);                     if (!pc.implies(subject)) {                        if (debug != null) {                            debug.println                                ("evaluation (principal comparator) failed");                        }                         // policy principal does not imply the current Subject -                        // immediately return and go to next policy entry                        return;                    }                }            } catch (Exception e) {                // fall back to regular principal comparison.                // see if policy entry principal is in current ACC                 if (debug != null) {                    e.printStackTrace();                }                 if (!checkEntryPs(principals, pppe)) {                    if (debug != null) {                        debug.println("evaluation (principals) failed");                    }                     // policy entry principal not in current ACC -                    // immediately return and go to next policy entry                    return;                }            }             // either the principal information matched,            // or the PrincipalComparator.implies succeeded.            // continue loop and test the next policy principal        }         // all policy entry principals were found in the current ACC -        // grant the policy permissions         if (debug != null) {            debug.println("evaluation (codesource/principals) passed");        }        addPerms(perms, principals, entry);    }     private void addPerms(Permissions perms,                        Principal[] accPs,                        PolicyEntry entry) {        for (int i = 0; i < entry.permissions.size(); i++) {            Permission p = entry.permissions.get(i);            if (debug != null) {                debug.println("  granting " + p);            }             if (p instanceof SelfPermission) {                // handle "SELF" permissions                expandSelf((SelfPermission)p,                        entry.getPrincipals(),                        accPs,                        perms);            } else {                perms.add(p);            }        }    }     /**     * This method returns, true, if the principal in the policy entry,     * pppe, is part of the current thread's principal array, pList.     * This method also returns, true, if the policy entry's principal     * is appropriately wildcarded.     *     * Note that the provided <i>pppe</i> argument may have     * wildcards (*) for both the <code>Principal</code> class and name.     *     * @param pList an array of principals from the current thread's

Lines 1001–1500 of 2437. Previous lines Load more