| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Uri:
- Add error correction (fix) of path at ctor
in case a a contained Uri is requested from an opaque one.
The latter might come from URI/URL and is not properly encoded!
See Uri.PARSE_HINT_FIX_PATH
- Simplify conversion methods:
- valueOf(URI/URL): Re-encode only if not opaque
- getNativeFilePath() -> toFile()
- Move IOUtil Uri related constants to class Uri
- Add DEBUG and DEBUG_SHOWFIX
- Complete adoption of URI -> Uri changes
- IOUtil, JarUtil and TempJarCache still holds some
left over deprecated methods, which will be removed
after officially starting 2.3.0 (JOGL dependencies)
- Otherwise not URI utilization left
- Tests
- Cleaned ip TestUri01 and TestUri03Resolving
- TestUri03Resolving also tests URL -> Uri,
and hence mentioned Uri.PARSE_HINT_FIX_PATH
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
used properly (Added unit test)
Bug 908 was caused by confusing URI encoded parts (e.g. scheme-specific-part) and it's decoded variant.
This especially happened due to:
- the fact, that the encoded and unencoded variant uses the same String type,
- the URI/URL decoding differs, is not complete (e.g. %20 .. SPACE remains in decoded part),
- and does not comply w/ RFC 2396 and RFC 3986 (encoding), e.g. not all RESERVED chars are encoded.
In branch 'v2.3.0_branch', we will introduce our own Uri and Uri.Encoded class
to solve above issue by replacing all URI usage w/ Uri.
- Backporting results of own Uri class introduction in branch 'v2.3.0_branch'
- Ensure the encoded URI parts are used where required, i.e. IOUtil.compose(..) etc
- TestNetIOURIReservedCharsBug908: Automated test, launching GlueGen jar file from an <i>odd pathname</i>.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
c47bc86ae2ee268a1f38c5580d11f93d7f8d6e74)
Code Clean-Up based on our Recommended Settings (jogamp-scripting c47bc86ae2ee268a1f38c5580d11f93d7f8d6e74)
- Change non static accesses to static members using declaring type
- Change indirect accesses to static members to direct accesses (accesses through subtypes)
- Add final modifier to private fields
- Add final modifier to method parameters
- Add final modifier to local variables
- Remove unnecessary casts
- Remove unnecessary '$NON-NLS$' tags
- Remove trailing white spaces on all lines
|
| |
|
|
| |
Dumper.dumpFullStats(..)
|
| |
|
|
| |
dump diffs per diff-type
|
| |
|
|
| |
branch): Using direct regexp for excludes
|
| |
|
|
|
|
|
| |
Refactor base semjar unit test class into
com.jogamp.junit.util.VersionSemanticsUtil, part of new gluegen-test-util.jar.
The new gluegen-test-util.jar shall be used by all other modules to test versioning.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
'@FixMethodOrder(MethodSorters.NAME_ASCENDING)' annotation
Issue: Java7 unit test order is no more predictable
Fix: junit 4.11 performs a determined (not defined default) test order.
Additionally user can force ascending method name test order
Produced a drop-in junit.jar / junit-source.zip replacement, which includes
- junit version version 4.11
- hamcrest-core version 1.3
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
access (2)
- Completes 23341a2df2d2ea36784a16fa1db8bc7385351a12
- Replace 'DynamicLinker' interface w/ well documented one
- All DynamicLinker methods are now considered secure, i.e.:
- open/lookup and close utilize reference counting on handle via a hash map.
- lookupSymbol(..) and close(..) impl. validate the passed library handle
whether it's retrieved via open*.
This is the fast path, not that expensive.
- lookupSymbolGlobal(..) performs
Check acccess of 'new RuntimePermission("loadLibrary.*")' if SecurityManager is installed.
This is the slow path.
- DynamicLibraryBundleInfo now reflects the security requirements,
i.e. whether priviledged access is needed.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
and privileged access)
This review focuses on how we perform permission checks,
or better - do we circumvent some assuming full privileges ?
Some native methods do need extra permission validation, i.e. loading native libraries.
Further more AccessController.doPrivileged(..) shall not cover generic code
exposing a critical feature to the user.
Further more .. we should rely on the SecuritManager, i.e. AccessControlContext's
'checkPermission(Permission)' code to comply w/ fine grained permission access.
It is also possible to have full permission w/o having any certificates (-> policy file).
+++
We remove implicit AccessController.doPrivileged(..) from within our trusted code
for generic methods, like Property access, temp. files.
+++
SecurityUtil:
- Remove 'getCommonAccessControlContext(Class<?> clz)',
which returned a local AccessControlContext for later restriction
if the passed class contains all certificates as the 'trusted' GlueGen class has.
- Simply expose convenient permission check methods relying on
SecurityManager / AccessControlContext.
PropertyAccess:
- 'protected static void addTrustedPrefix(..)' requires AllPermissions if SecurityManager is installed.
- Remove implicit doPrivileged(..) triggered by passed AccessControlContext instance,
only leave it for trusted prefixes.
IOUtil:
- Remove all doPrivileged(..) - Elevation shall be performed by caller.
DynamicLinker:
- 'public long openLibraryLocal(..)' and 'public long openLibraryGlobal(..)'
may throw SecurityException, if a SecurityManager is installed and the dyn. link permission
is not granted in the calling code.
Implemented in their respective Unix, OSX and Windows manifestation.
Caller has to elevate privileges via 'doPrivileged(..) {}' !
+++
Tests:
- Property access
- File access
- Native library loading
Manual Applet test (unsigned, but w/ SecurityManager and policy file):
> gluegen/test/applet
Applet has been tested w/ signed JAR w/ Firefox and Java7 on GNU/Linux as well.
Manual Application test (unsigned, but w/ SecurityManager and policy file):
com.jogamp.junit.sec.TestSecIOUtil01
- Run w/ SecurityManager and policy file:
- gluegen/scripts/runtest-secmgr.sh
- Run w/o SecurityManager:
- gluegen/scripts/runtest.sh
|
| |
|
|
| |
most of tests in TestJarUtil
|
| | |
|
| |
|
