From: | pgsql-bugs(at)postgresql(dot)org |
---|---|
To: | pgsql-bugs(at)postgresql(dot)org |
Subject: | Bug #424: JDBC driver security issue. |
Date: | 2001-08-24 00:17:51 |
Message-ID: | 200108240017.f7O0Hp842565@hub.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs pgsql-jdbc |
David Daney (David(dot)Daney(at)avtrex(dot)com) reports a bug with a severity of 3
The lower the number the more severe it is.
Short Description
JDBC driver security issue.
Long Description
The JDBC driver requires
permission java.lang.RuntimePermission "shutdownHooks";
in the policy file in order to function. However the driver does not protect the shutdown hooks call in an AccessController.doPrivileged() call, so these permissions must be granted to all code not just the postgres JDBC driver.
Sample Code
Here is a diff that fixes the problem.
*** ConnectionHook.java.orig Mon Mar 5 01:17:43 2001
--- ConnectionHook.java Thu Aug 23 16:51:49 2001
***************
*** 1,6 ****
--- 1,9 ----
package org.postgresql.core;
import java.sql.SQLException;
+ import java.security.AccessController;
+ import java.security.PrivilegedAction;
+
import java.util.ArrayList;
import java.util.Iterator;
import org.postgresql.Connection;
***************
*** 51,57 ****
*/
private ConnectionHook() {
super();
! Runtime.getRuntime().addShutdownHook(new Thread(this));
}
/**
--- 54,65 ----
*/
private ConnectionHook() {
super();
! AccessController.doPrivileged(new PrivilegedAction() {
! public Object run() {
! Runtime.getRuntime().addShutdownHook(new Thread(ConnectionHook.this));
! return null; // nothing to return
! }
! });
}
/**
No file was uploaded with this report
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2001-08-24 00:46:14 | Re: memory leak while using vaccum |
Previous Message | pgsql-bugs | 2001-08-23 18:41:04 | Bug #423: unable to do selects on certain fields in large tables |
From | Date | Subject | |
---|---|---|---|
Next Message | Hiroshi Inoue | 2001-08-24 00:54:31 | Re: Re: [JDBC] New backend functions? [was Re: JDBC changes for 7.2... some questions...] |
Previous Message | Ned Wolpert | 2001-08-23 22:27:29 | Re: Re: [JDBC] New backend functions? [was Re: JDBC ch |