Class Loading Security Restrictions

Hi,
Does WebLogic Server have any feature through which application code "may not" get access to BEA system classes (like classes in weblogic.jar or any security sensitive classes) ? As I understand, any application user can walk their way to BEA internal classes through classloading heirarchy or reflection ?
Thanks,
Krish

Hi Krish,
Welcome to the world of Java, where nothing is ever really inaccessible. In answer to you question, some of the functionality in terms of security is marked as private or protected internally to protect the functionality from other Java classes and inheritence, but not the ones you'd expect. The security around the Licensing classes is a substantial step above those that exist around actual authentication providers and encryption services.
To be fair though, using tools like WLST/Jython renders all internal functionality protection moot anyway, as Jython will happily run methods and classes that are scoped as private. This is a particular problem with WebLogic internal credential encryption.
Cheers,
Trevor Nielsen
londonmiddleware.org

Similar Messages

  • Cocoon2 weblogic (5.1 sp6) class loader security problem

    Hello folks,
    System:
    Cocoon: v2.0
    JDK: Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.0-C),
    Java HotSpot(TM) Client VM (build 1.3.0-C, mixed mode)
    OS: NT4 SP5
    Servlet: v2.2
    AppServer: Weblogic 5.1 SP6
    Symptoms:
    I've updated our application from Cocoon 1.7.4 to Cocoon2. After I
    figured out what libraries I need on the Weblogic's classpath, I managed
    to envoke the MyServlet (MyServlet extends CocoonServlet). The technique
    I am using is the one I used with the Cocoon v1.7.4: extend Cocoon
    servlet and wrap the HttpServletRequest in MyRequest to provide the XML
    content. I changed the line <map:generators default="request"> in
    sitemap.xmap to specify the location of the source. Configuration files
    seem to be read correctly and the file
    <myWebAppContext>/WEB-INF/_tmp_war/org/apache/cocoon/www/sitemap_xmap.java
    is generated (but there is no class file generated)!
    I looked at the cocoon.log file and looks like a class loader security
    problem: the \WEB-INF\_tmp_war gets locked! Is there any workaround this
    problem? Any help is much appreciated!
    cocoon.log file generated:
    DEBUG 62 [cocoon  ] (ExecuteThread-11): Using configuration file:
    /cocoon.xconf
    INFO 62 [cocoon  ] (ExecuteThread-11): Reloading from:
    file:D:/Programs/cocoon-1.8.2/samples/cocoon.xconf
    DEBUG 93 [cocoon  ] (ExecuteThread-11): New Cocoon object.
    DEBUG 93 [cocoon  ] (ExecuteThread-11): Using parser:
    org.apache.cocoon.components.parser.JaxpParser
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Creating Repository with
    this directory: D:\programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Classpath =
    D:\Programs\cocoon-1.8.2\samples\WEB-INF\classes;D:\Programs\cocoon-1.8.2\samples\WEB-INF\lib\javac.jar;D:\avue\lib\servlet.jar;D:\avue\lib\jaxp.jar;D:\avue\lib\xerces.jar;D:\avue\lib\xalan.jar;D:\avue\lib\cocoon.jar;D:\avue\lib\avalonapi.jar;D:\avue\lib\logkit.jar;D:\avue\lib\maybeupload.jar;D:\avue\lib\jakarta-regexp-1.2.jar;D:\avue\lib\jstyle.jar;D:\avue\lib\javac.jar;D:\weblogic\lib\weblogic510sp6boot.jar;D:\weblogic\classes\boot;
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Work directory =
    D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war
    DEBUG 125 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Root configuration:
    cocoon
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Configuration version:
    2.0
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Setting up components...
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.parser.Parser =
    org.apache.cocoon.components.parser.JaxpParser)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.generator.ProgramGenerator =
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.url.URLFactory =
    org.apache.cocoon.components.url.URLFactoryImpl)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.saxconnector.SAXConnector =
    org.apache.cocoon.components.saxconnector.NullSAXConnector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.avalon.util.datasource.DataSourceComponentSelector =
    org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.avalon.util.pool.PoolController =
    org.apache.cocoon.components.ComponentPoolController)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.programming.ProgrammingLanguageSelector
    = org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.markup.MarkupLanguageSelector =
    org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.store.Store =
    org.apache.cocoon.components.store.MemoryStore)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.classloader.ClassLoaderManager =
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Setting up the sitemap.
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Sitemap location =
    sitemap.xmap
    DEBUG 703 [cocoon  ] (ExecuteThread-11): ComponentFactory creating
    new instance of org.apache.cocoon.components.url.URLFactoryImpl.
    DEBUG 703 [cocoon  ] (ExecuteThread-11): Getting the URLFactories
    DEBUG 703 [cocoon  ] (ExecuteThread-11): for protocol:
    resource org.apache.cocoon.components.url.ResourceURLFactory
    DEBUG 718 [cocoon  ] (ExecuteThread-11): for protocol: context
    org.apache.cocoon.components.url.ContextURLFactory
    DEBUG 718 [cocoon  ] (ExecuteThread-11): Beginning sitemap
    regeneration
    DEBUG 718 [cocoon  ] (ExecuteThread-11): Making URL from
    file:/D:/Programs/cocoon-1.8.2/samples/sitemap.xmap
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.
    DEBUG 718 [cocoon  ] (Thread-1): Could not find ComponentHandler,
    attempting to create one for role:
    org.apache.cocoon.components.language.generator.ServerPagesSelector
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.generator.GeneratorSelector.
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.
    DEBUG 718 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element:
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of org.apache.cocoon.components.CocoonComponentSelector.
    DEBUG 718 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element: markup-languages
    DEBUG 734 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.markup.xsp.XSPMarkupLanguage for
    xsp
    DEBUG 734 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage
    for sitemap
    DEBUG 734 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of org.apache.cocoon.components.CocoonComponentSelector.
    DEBUG 734 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element: programming-languages
    DEBUG 750 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.programming.java.JavaLanguage.
    DEBUG 750 [cocoon  ] (Thread-1): Looking up
    org.apache.cocoon.components.classloader.ClassLoaderManager
    DEBUG 750 [cocoon  ] (Thread-1): Setting the parameters
    DEBUG 750 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.programming.java.JavaLanguage for
    java
    DEBUG 765 [cocoon  ] (Thread-1): The instance was not accessible,
    creating it now.
    DEBUG 765 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 1718 [cocoon  ] (Thread-1): Making URL from
    jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    DEBUG 1718 [cocoon  ] (Thread-1): Logicsheet
    Used:jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    WARN 4109 [cocoon  ] (Thread-1): Could not load class for program
    'org\apache\cocoon\www\sitemap_xmap'
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)
    at
    java.security.AccessController.checkPermission(AccessController.java:399)
    at
    java.lang.SecurityManager.checkPermission(SecurityManager.java:545)
    at java.net.URLClassLoader$5.run(URLClassLoader.java:463)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.getPermissions(URLClassLoader.java:461)
    at
    java.security.SecureClassLoader.getProtectionDomain(SecureClassLoader.java:162)
    at
    java.security.SecureClassLoader.defineClass(SecureClassLoader.java:111)
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:248)
    at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
    at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:297)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:253)
    at
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.loadClass(ClassLoaderManagerImpl.java:58)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:121)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:163)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): Language Exception
    org.apache.cocoon.components.language.LanguageException: Could not load
    class for program 'org\apache\cocoon\www\sitemap_xmap' due to a
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:124)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:163)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): ComponentFactory decommissioning
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 4109 [cocoon  ] (Thread-1): Can't load ServerPage
    org.apache.avalon.ComponentManagerException: Could not add component for
    class: org.apache.cocoon.www.sitemap_xmap
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.addGenerator(GeneratorSelector.java:61)
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.select(GeneratorSelector.java:50)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.select(ProgramGeneratorImpl.java:263)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:172)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 4359 [cocoon  ] (Thread-1): Making URL from
    jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    DEBUG 4359 [cocoon  ] (Thread-1): Logicsheet
    Used:jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    WARN 6109 [cocoon  ] (Thread-1): Could not load class for program
    'org\apache\cocoon\www\sitemap_xmap'
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)
    at
    java.security.AccessController.checkPermission(AccessController.java:399)
    at
    java.lang.SecurityManager.checkPermission(SecurityManager.java:545)
    at java.net.URLClassLoader$5.run(URLClassLoader.java:463)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.getPermissions(URLClassLoader.java:461)
    at
    java.security.SecureClassLoader.getProtectionDomain(SecureClassLoader.java:162)
    at
    java.security.SecureClassLoader.defineClass(SecureClassLoader.java:111)
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:248)
    at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
    at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:297)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:253)
    at
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.loadClass(ClassLoaderManagerImpl.java:58)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:121)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:210)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (Thread-1): Language Exception
    org.apache.cocoon.components.language.LanguageException: Could not load
    class for program 'org\apache\cocoon\www\sitemap_xmap' due to a
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:124)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:210)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (Thread-1): ComponentFactory decommissioning
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    ERROR 6109 [cocoon  ] (Thread-1): Error compiling sitemap
    org.apache.avalon.ComponentManagerException: Could not add component for
    class: org.apache.cocoon.www.sitemap_xmap
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.addGenerator(GeneratorSelector.java:61)
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.select(GeneratorSelector.java:50)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.select(ProgramGeneratorImpl.java:263)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:219)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): Changing Cocoon
    context(sitemap.xmap) to prefix()
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): from
    context(file:/D:/Programs/cocoon-1.8.2/samples/) and prefix()
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): at URI
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): New context is
    file:/D:/Programs/cocoon-1.8.2/samples/
    ERROR 6140 [cocoon  ] (ExecuteThread-11): Problem with servlet
    org.apache.cocoon.ProcessingException: The sitemap handler's sitemap is
    not available.
    at org.apache.cocoon.sitemap.Manager.invoke(Manager.java:106)
    at org.apache.cocoon.Cocoon.process(Cocoon.java:218)
    at
    org.apache.cocoon.servlet.CocoonServlet.service(CocoonServlet.java:417)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
    at
    weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:123)
    at
    weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:761)
    at
    weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:708)
    at
    weblogic.servlet.internal.ServletContextManager.invokeServlet(ServletContextManager.java:252)
    at
    weblogic.socket.MuxableSocketHTTP.invokeServlet(MuxableSocketHTTP.java:346)
    at
    weblogic.socket.MuxableSocketHTTP.execute(MuxableSocketHTTP.java:246)
    at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:135)
    INFO 6187 [cocoon  ] (ExecuteThread-11): '' Processed by Apache
    Cocoon 2.0a4 in 5.75 seconds.
    ================================================================
    Regards,
    Georgi

    Hello folks,
    System:
    Cocoon: v2.0
    JDK: Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.0-C),
    Java HotSpot(TM) Client VM (build 1.3.0-C, mixed mode)
    OS: NT4 SP5
    Servlet: v2.2
    AppServer: Weblogic 5.1 SP6
    Symptoms:
    I've updated our application from Cocoon 1.7.4 to Cocoon2. After I
    figured out what libraries I need on the Weblogic's classpath, I managed
    to envoke the MyServlet (MyServlet extends CocoonServlet). The technique
    I am using is the one I used with the Cocoon v1.7.4: extend Cocoon
    servlet and wrap the HttpServletRequest in MyRequest to provide the XML
    content. I changed the line <map:generators default="request"> in
    sitemap.xmap to specify the location of the source. Configuration files
    seem to be read correctly and the file
    <myWebAppContext>/WEB-INF/_tmp_war/org/apache/cocoon/www/sitemap_xmap.java
    is generated (but there is no class file generated)!
    I looked at the cocoon.log file and looks like a class loader security
    problem: the \WEB-INF\_tmp_war gets locked! Is there any workaround this
    problem? Any help is much appreciated!
    cocoon.log file generated:
    DEBUG 62 [cocoon  ] (ExecuteThread-11): Using configuration file:
    /cocoon.xconf
    INFO 62 [cocoon  ] (ExecuteThread-11): Reloading from:
    file:D:/Programs/cocoon-1.8.2/samples/cocoon.xconf
    DEBUG 93 [cocoon  ] (ExecuteThread-11): New Cocoon object.
    DEBUG 93 [cocoon  ] (ExecuteThread-11): Using parser:
    org.apache.cocoon.components.parser.JaxpParser
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Creating Repository with
    this directory: D:\programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Classpath =
    D:\Programs\cocoon-1.8.2\samples\WEB-INF\classes;D:\Programs\cocoon-1.8.2\samples\WEB-INF\lib\javac.jar;D:\avue\lib\servlet.jar;D:\avue\lib\jaxp.jar;D:\avue\lib\xerces.jar;D:\avue\lib\xalan.jar;D:\avue\lib\cocoon.jar;D:\avue\lib\avalonapi.jar;D:\avue\lib\logkit.jar;D:\avue\lib\maybeupload.jar;D:\avue\lib\jakarta-regexp-1.2.jar;D:\avue\lib\jstyle.jar;D:\avue\lib\javac.jar;D:\weblogic\lib\weblogic510sp6boot.jar;D:\weblogic\classes\boot;
    DEBUG 109 [cocoon  ] (ExecuteThread-11): Work directory =
    D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war
    DEBUG 125 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 140 [cocoon  ] (Thread-0): ComponentFactory creating new
    instance of org.apache.cocoon.components.parser.JaxpParser.
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Root configuration:
    cocoon
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Configuration version:
    2.0
    DEBUG 390 [cocoon  ] (ExecuteThread-11): Setting up components...
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.parser.Parser =
    org.apache.cocoon.components.parser.JaxpParser)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.generator.ProgramGenerator =
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.url.URLFactory =
    org.apache.cocoon.components.url.URLFactoryImpl)
    DEBUG 406 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.saxconnector.SAXConnector =
    org.apache.cocoon.components.saxconnector.NullSAXConnector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.avalon.util.datasource.DataSourceComponentSelector =
    org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.avalon.util.pool.PoolController =
    org.apache.cocoon.components.ComponentPoolController)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.programming.ProgrammingLanguageSelector
    = org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.language.markup.MarkupLanguageSelector =
    org.apache.cocoon.components.CocoonComponentSelector)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.store.Store =
    org.apache.cocoon.components.store.MemoryStore)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Adding component
    (org.apache.cocoon.components.classloader.ClassLoaderManager =
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl)
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Setting up the sitemap.
    DEBUG 422 [cocoon  ] (ExecuteThread-11): Sitemap location =
    sitemap.xmap
    DEBUG 703 [cocoon  ] (ExecuteThread-11): ComponentFactory creating
    new instance of org.apache.cocoon.components.url.URLFactoryImpl.
    DEBUG 703 [cocoon  ] (ExecuteThread-11): Getting the URLFactories
    DEBUG 703 [cocoon  ] (ExecuteThread-11): for protocol:
    resource org.apache.cocoon.components.url.ResourceURLFactory
    DEBUG 718 [cocoon  ] (ExecuteThread-11): for protocol: context
    org.apache.cocoon.components.url.ContextURLFactory
    DEBUG 718 [cocoon  ] (ExecuteThread-11): Beginning sitemap
    regeneration
    DEBUG 718 [cocoon  ] (ExecuteThread-11): Making URL from
    file:/D:/Programs/cocoon-1.8.2/samples/sitemap.xmap
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.
    DEBUG 718 [cocoon  ] (Thread-1): Could not find ComponentHandler,
    attempting to create one for role:
    org.apache.cocoon.components.language.generator.ServerPagesSelector
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.generator.GeneratorSelector.
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.
    DEBUG 718 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element:
    DEBUG 718 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of org.apache.cocoon.components.CocoonComponentSelector.
    DEBUG 718 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element: markup-languages
    DEBUG 734 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.markup.xsp.XSPMarkupLanguage for
    xsp
    DEBUG 734 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage
    for sitemap
    DEBUG 734 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of org.apache.cocoon.components.CocoonComponentSelector.
    DEBUG 734 [cocoon  ] (Thread-1): CocoonComponentSelector setting
    up with root element: programming-languages
    DEBUG 750 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.programming.java.JavaLanguage.
    DEBUG 750 [cocoon  ] (Thread-1): Looking up
    org.apache.cocoon.components.classloader.ClassLoaderManager
    DEBUG 750 [cocoon  ] (Thread-1): Setting the parameters
    DEBUG 750 [cocoon  ] (Thread-1): Adding
    org.apache.cocoon.components.language.programming.java.JavaLanguage for
    java
    DEBUG 765 [cocoon  ] (Thread-1): The instance was not accessible,
    creating it now.
    DEBUG 765 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 1718 [cocoon  ] (Thread-1): Making URL from
    jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    DEBUG 1718 [cocoon  ] (Thread-1): Logicsheet
    Used:jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    WARN 4109 [cocoon  ] (Thread-1): Could not load class for program
    'org\apache\cocoon\www\sitemap_xmap'
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)
    at
    java.security.AccessController.checkPermission(AccessController.java:399)
    at
    java.lang.SecurityManager.checkPermission(SecurityManager.java:545)
    at java.net.URLClassLoader$5.run(URLClassLoader.java:463)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.getPermissions(URLClassLoader.java:461)
    at
    java.security.SecureClassLoader.getProtectionDomain(SecureClassLoader.java:162)
    at
    java.security.SecureClassLoader.defineClass(SecureClassLoader.java:111)
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:248)
    at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
    at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:297)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:253)
    at
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.loadClass(ClassLoaderManagerImpl.java:58)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:121)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:163)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): Language Exception
    org.apache.cocoon.components.language.LanguageException: Could not load
    class for program 'org\apache\cocoon\www\sitemap_xmap' due to a
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:124)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:163)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): ComponentFactory decommissioning
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 4109 [cocoon  ] (Thread-1): Can't load ServerPage
    org.apache.avalon.ComponentManagerException: Could not add component for
    class: org.apache.cocoon.www.sitemap_xmap
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.addGenerator(GeneratorSelector.java:61)
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.select(GeneratorSelector.java:50)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.select(ProgramGeneratorImpl.java:263)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:172)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 4109 [cocoon  ] (Thread-1): ComponentFactory creating new
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    DEBUG 4359 [cocoon  ] (Thread-1): Making URL from
    jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    DEBUG 4359 [cocoon  ] (Thread-1): Logicsheet
    Used:jar:file:/D:/avue/lib/cocoon.jar!/org/apache/cocoon/components/language/markup/sitemap/java/sitemap.xsl
    WARN 6109 [cocoon  ] (Thread-1): Could not load class for program
    'org\apache\cocoon\www\sitemap_xmap'
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)
    at
    java.security.AccessController.checkPermission(AccessController.java:399)
    at
    java.lang.SecurityManager.checkPermission(SecurityManager.java:545)
    at java.net.URLClassLoader$5.run(URLClassLoader.java:463)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.getPermissions(URLClassLoader.java:461)
    at
    java.security.SecureClassLoader.getProtectionDomain(SecureClassLoader.java:162)
    at
    java.security.SecureClassLoader.defineClass(SecureClassLoader.java:111)
    at java.net.URLClassLoader.defineClass(URLClassLoader.java:248)
    at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
    at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:297)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:253)
    at
    org.apache.cocoon.components.classloader.ClassLoaderManagerImpl.loadClass(ClassLoaderManagerImpl.java:58)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:121)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:210)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (Thread-1): Language Exception
    org.apache.cocoon.components.language.LanguageException: Could not load
    class for program 'org\apache\cocoon\www\sitemap_xmap' due to a
    java.security.AccessControlException: access denied
    (java.io.FilePermission
    \D:\Programs\cocoon-1.8.2\samples\WEB-INF\_tmp_war\- read)
    at
    org.apache.cocoon.components.language.programming.java.JavaLanguage.loadProgram(JavaLanguage.java:124)
    at
    org.apache.cocoon.components.language.programming.CompiledProgrammingLanguage.load(CompiledProgrammingLanguage.java:119)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.generateResource(ProgramGeneratorImpl.java:245)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:210)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (Thread-1): ComponentFactory decommissioning
    instance of
    org.apache.cocoon.components.language.markup.sitemap.SitemapMarkupLanguage.
    ERROR 6109 [cocoon  ] (Thread-1): Error compiling sitemap
    org.apache.avalon.ComponentManagerException: Could not add component for
    class: org.apache.cocoon.www.sitemap_xmap
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.addGenerator(GeneratorSelector.java:61)
    at
    org.apache.cocoon.components.language.generator.GeneratorSelector.select(GeneratorSelector.java:50)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.select(ProgramGeneratorImpl.java:263)
    at
    org.apache.cocoon.components.language.generator.ProgramGeneratorImpl.load(ProgramGeneratorImpl.java:219)
    at org.apache.cocoon.sitemap.Handler.run(Handler.java:173)
    at java.lang.Thread.run(Thread.java:484)
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): Changing Cocoon
    context(sitemap.xmap) to prefix()
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): from
    context(file:/D:/Programs/cocoon-1.8.2/samples/) and prefix()
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): at URI
    DEBUG 6109 [cocoon  ] (ExecuteThread-11): New context is
    file:/D:/Programs/cocoon-1.8.2/samples/
    ERROR 6140 [cocoon  ] (ExecuteThread-11): Problem with servlet
    org.apache.cocoon.ProcessingException: The sitemap handler's sitemap is
    not available.
    at org.apache.cocoon.sitemap.Manager.invoke(Manager.java:106)
    at org.apache.cocoon.Cocoon.process(Cocoon.java:218)
    at
    org.apache.cocoon.servlet.CocoonServlet.service(CocoonServlet.java:417)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
    at
    weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:123)
    at
    weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:761)
    at
    weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:708)
    at
    weblogic.servlet.internal.ServletContextManager.invokeServlet(ServletContextManager.java:252)
    at
    weblogic.socket.MuxableSocketHTTP.invokeServlet(MuxableSocketHTTP.java:346)
    at
    weblogic.socket.MuxableSocketHTTP.execute(MuxableSocketHTTP.java:246)
    at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:135)
    INFO 6187 [cocoon  ] (ExecuteThread-11): '' Processed by Apache
    Cocoon 2.0a4 in 5.75 seconds.
    ================================================================
    Regards,
    Georgi

  • Implementing a secure class loader..

    Hello,
    We have a custom class loader which loads in custom packages from the database or from the file system. We want to ensure that these custom classes do not read or write into the file system. I want to restrict access to these classes when creating them. I read that by setting the proper permissions when defining the class, this could be possible. Here is my implementation of the class loader :
    import java.io.File;
    import java.io.FileInputStream;
    import java.io.FilePermission;
    import java.io.IOException;
    import java.net.SocketPermission;
    import java.net.URL;
    import java.security.AccessController;
    import java.security.CodeSource;
    import java.security.PermissionCollection;
    import java.security.Permissions;
    import java.security.PrivilegedExceptionAction;
    import java.security.SecureClassLoader;
    public class TestClassLoader extends SecureClassLoader {
            JarParser jp;
            public TestClassLoader(JarParser jp) {
              super();
                    this.jp = jp;
            public Class findClass(final String name) throws ClassNotFoundException {
                   try {
                       return(Class)
                               AccessController.doPrivileged (
                                     new PrivilegedExceptionAction() {
                                                   public Object run() throws ClassNotFoundException {
                                                         byte[] buf = null;
                                                            try {
                                                               if(jp == null)
                                                                      throw new ClassNotFoundException("Jar file not found");
                                                                    String className = name.replace( '.', '/' ) + ".class";
                                                                    buf = jp.getResource(className);
                                                                    if(buf == null || buf.length == 0)
                                                                          throw new ClassNotFoundException("Class not found");
                                                                    CodeSource cs = getCodeSource(name);
                                                                    return defineClass(name, buf, 0, buf.length, cs);
                                                           catch(Exception e) {
                                                                throw new ClassNotFoundException(name, e);
                   catch(Exception e) {
                        throw new ClassNotFoundException(name, e);
          * @param name
         protected CodeSource getCodeSource(String name) {
                   try {
                       return new CodeSource(new URL("file", "localhost", name), null);
                   catch(Exception e){
                         e.printStackTrace();
                    return null;
            protected PermissionCollection getPermissions(CodeSource cs) {
              PermissionCollection pc = new Permissions();
                    pc.add(new RuntimePermission("exitVM"));
                    pc.add(new FilePermission("${user.home}${/}*", "read"));
                    pc.add(new FilePermission("${user.dir}${/}*", "read"));
             pc.add(new SocketPermission("localhost", "resolve"));
                    return pc;
            public static void main(String[] args) {
                    try {
                       byte[] bytes = new byte[8192];
                      long ttlBytesRead = 0;
                      int noOfBytesToRead = 0;
                            File readFile = new File("test.jar");
                            // "length" here indicates the total no of bytes to read.
                          // This is equal to the file size sans the offset value.
                            long length = readFile.length();
                            Long temp;
                          FileInputStream readFis = null;
                            // Create the RandomAccessFile
                      try{
                                 readFis = new FileInputStream(readFile);
                           catch(Exception e) {
                                throw new IOException(e.getMessage());
                           long tempLong;
                      StringBuffer buffer = new StringBuffer();
                            do {
                                if ((length - ttlBytesRead) > 8192)
                                         tempLong = 8192;
                                    else
                                        tempLong = (length - ttlBytesRead);
                                 temp = new Long((length - ttlBytesRead) > 8192 ? 8192 : (length - ttlBytesRead));
                                   noOfBytesToRead = temp.intValue();
                                  if(noOfBytesToRead == 0)
                                            break;
                              // Read the specified no of bytes into the byte
                                    // array from the file.
                             try {
                                       readFis.read(bytes,0,noOfBytesToRead);
                                   catch(Exception e1) {
                                       throw new IOException(e1.getMessage());
                                   String str  = new String(bytes, 0, noOfBytesToRead);
                                buffer.append(str);
                                    ttlBytesRead += noOfBytesToRead;
                            } while(ttlBytesRead < length);
                     try {
                               readFis.close();
                           catch(Exception e1) {}
                            JarParser jp = new JarParser("test.jar", buffer.toString().getBytes());
                     TestClassLoader tcl = new TestClassLoader(jp);
                      Class class1 = tcl.findClass("com.test.TestFileWrite");
                     Object obj = class1.newInstance();
                   catch(Exception e) {
                        e.printStackTrace();
    }JarParser is the class which parses through the jar file and caches the contents as bytes.
    The test.jar contains a single class which writes into the user's home directory. As you can see, I have granted only read access on the home dir.
    When I run this however, the newly loaded class does manage to write into the file system with no problems. Is there anything further that I need to do to enable restriction on the file system ?
    Thanks.

    If I've been reading correctly, they don't want you
    subclassing SecurityManager for security any more.
    Everything should be handled by the AccessController
    using Permission objects. The easiest way to configure
    the AccessController is through policy files.erg. where did you read this? I checked the 1.5.0 beta API just now, and nothing is officially deprecated.
    :{  I don't have time to figure out the AccessController API right now.
    I have yet to find a good tutorial on the matter of
    security and classloaders. If anyone has a good
    reference, it would be much appreciated.I second that.
    And as a temporary solution (because we're already behind schedule), I went ahead and wrote my own SecurityManager, using the ideas I mentioned above.
    I'm posting it at the site below in case anyone can offer any feedback (such as pointing out fatal weaknesses). We tried yesterday for an hour or so to break it, and it withstood all our tests; but security is not our specialty, so there's probably room for improvement.
    (I'd post it in this message, but it's a wee bit large.)
    www.personal.utulsa.edu/~jeremy-wood/software/ThreadBasedSecurityManager.java
    (And if it passes your scrutiny and looks useful, feel free to use it. But note the disclaimers.)

  • Class Loading Strategy for Security MBeans

    Hi, can someone point me to a good reference or explain how security mbeans load referenced classes? I'm trying to reference my auditor class, which is archived in an audit.jar, from within my authentication provider mbean implementation class. I've added the attribute class-path:audit.jar in the manifest file of the mbean jar file containing the authentication provider class. Every time I start the server I get a "NoClassDefFoundError" exception. Any ideas?

    Someone else can probably answer with more authority, but I think that statement is true because Java 2 introduced context class loaders, or at least formalized the hierarchical relationship between context class loaders.
    Each thread by definition has a context class loader, possibly (probably) through inheritance from its parent thread.
    According to the API doc, Class.forName() loads a class using the current class's classLoader, whereas getContextClassLoader().loadClass() loads a class using the thread's context class loader.
    I think there could be cases where a context class loader could have access to resoures that the class's class loader doesn't. If anyone can shed more light on this, that would be helpful.
    There's some discussion of this here:
    http://java.sun.com/products/jndi/tutorial/beyond/misc/classloader.html, mainly in regards to JNI.

  • No security manager: RMI class loader disabled

    i tried to add a filter to my client jmx
    my filter is:
    class Filter implements NotificationFilter {
    public boolean isNotificationEnabled(Notification n) {
              return (n.getType().equals("example.user.remove"))
              ? true
              : false;
    in my client i use:
    Filter filter=new Filter();
    Listener listener=new Listener();
    mbeanServer.addNotificationListener(mbeanName, listener, filter, null);
    if i dont put the filter(if i use null) my client works but when i include the filter I have this error:
    java.rmi.UnmarshalException: java.lang.ClassNotFoundException: Filter (no security manager: RMI class loader disabled); nested exception is:
         java.lang.ClassNotFoundException: Filter (no security manager: RMI class loader disabled)
    what is wrong?

    You need to make sure that Filter.class is on your classpath, either directly as the .class file or in a JAR file that is on the classpath.

  • No security manager: RMI class loader disabled Error at RMI client programm

    Got following error on invoking remote method from RMI client,
    java.rmi.UnmarshalException: error unmarshalling return; nested exception is:
    java.lang.ClassNotFoundException: com.rmi.RmiImpl_Stub (no security manager: RMI class loader disabled)
    Please let me know solution.

    Hello JAAZ,
    I got the same error yesterday. I was a little frustrated, because the day before everything was fine...
    java.rmi.UnmarshalException: error unmarshalling return; nested exception is:
            java.lang.ClassNotFoundException: uk.co.it.ete.server.ETE_Server (no security manager: RMI class loader disabled)
            at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)The solution was, that I did some refactoring and some of the classes were now in different packages. I updated the system on the client-side and now everything works again.
    I think debugging RMI-applications is not as easy as "normal" applications ..
    maybe this helps..
    Regards
    tk

  • Simple RMI/IIOP app : "no security manager: RMI class loader disabled"

    Hello colleagues!
    I do not understand the problem at all, and asking for your kind help.
    This is my first code for RMI/IIOP. We are using JBoss as application server.
    What I've done :
    1) created test.Command interface , extending Remote
    2) created test.CommandImpl , implementing above mentioned interface and java.io.Serializable, and extending javax.rmi.PortableRemoteObject.
    BTW, Serializable is not implemented in some tutorials, but absence of Serializable causes NotSerializableException when trying to rebind (next step).
    3) in server code, created initial context and called
    context.rebind("test/Command",new CommandImpl());
    4) Ran rmic -iiop test.CommandImpl . A result was two new cass files, CommandImplTie.class and CommandStub.class , both are also in package "test".
    5) Created remote client and put CommandStub.class to client
    classpath (under package "test", too).
    6) In client code, initialized the context and called
    context.lookup("test/Command").
    On this line (lookup), the following exception is being raised :
    javax.naming.CommunicationException. Root exception is java.lang.ClassNotFoundException: test.CommandImpl (no security manager: RMI class loader disabled)
         at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:368)
         at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:161)
         at java.rmi.server.RMIClassLoader$2.loadClass(RMIClassLoader.java:631)
         at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:257)
         at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:200)
         at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1513)
         at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1435)
         at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1626)
         at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1274)
         at java.io.ObjectInputStream.readObject(ObjectInputStream.java:324)
         at java.rmi.MarshalledObject.get(MarshalledObject.java:135)
         at org.jnp.interfaces.MarshalledValuePair.get(MarshalledValuePair.java:30)
         at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:514)
         at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:471)
         at javax.naming.InitialContext.lookup(InitialContext.java:347)
    Is _Stub class all that client needs from server classes, to obtain
    the reference ? I tried to put _Tie also to client, but with the same result.
    All Jndi paths to JBoss server are correct, as I've used them successfully in other applications.
    Many thanks in advance,
    Daniel

    Next few words to the topic.
    I made tests with canonical RMI/IIOP tutorial from Sun.
    When I use Sun's ORB (orbd.exe) , everything work fine. I started
    orbd on the same PC as JBoss, and client and server are running
    remotely.
    But with JBoss ORB, I have the same exception as described above.
    Server starts and registers in JNDI successfully, but client can not
    obtain a remote reference. Exception is being thrown on
    context.lookup().
    So the difference is definitely in security managers for two ORBs.
    I also tried to create new RMISecurityMananger and set it, but with
    no effect.
    Any ideas ?
    TIA,
    Daniel.

  • Security restrictions , how to read access a txt file supplied in a jar

    I had written a simple application which uses file handling to display random line from a file on a swing window
    but I do not know how to give my web application permission to access a file
    when I set security permission to all, then error says the application cannot load because the code require unrestricted acess to system resources and is unsigned, I don't know how to get that certificate and I am only doing it for learning purposes.
    when I remove security permissions then it says
    access denied java.io.FilePermissions geekjoskes.txt readPlease help
    I locally signed the jar file, and give my jnlp fiel all permissions, worked fine in my system but when I access same file from local lan it sho errors ,
    please help, I have my txt file stored in my jar file with main class
    the whole jnlp file is
    <?xml version="1.0" encoding="utf-8"?>
    <!-- JNLP File for geek jokes -->     
    <jnlp spec="1.0+"
           codebase="http://localhost/javasoft/webstart/"
          href="geekjokes.jnlp">
       <information>
          <title>Geek Jokes</title>
          <vendor>Vaibhav Mishra</vendor>
          <description>Geeky jokes</description>
          <homepage href="http://scjpbeginner.blogspot.com"/>
          <description kind="short">shows random jokes</description>
          <offline-allowed/>
       </information>
       <resources>    
            <jar href="GeekJokes0.1.jar"/>  
         <j2se version="1.6+"
               href="http://java.sun.com/products/autodl/j2se"/>
         <icon href="geekjokes.gif"/>
       <icon kind="splash" href = "geekjokes.gif"/>
       </resources>
       <security>
          <all-permissions/>
       </security>
       <offline-allowed/>  
       <application-desc main-class="GeekJokes"/>
    </jnlp>Edited by: 76jsr on Aug 7, 2008 3:45 PM
    Edited by: 76jsr on Aug 7, 2008 3:49 PM

    >
    I am extremely thankful to you and finally my first little app is working thanks to you,
    here is it's link
    [http://profile.iiita.ac.in/IIT2006117/javasoft/webstart/geekjokes/geekjokes.jnlp|http://profile.iiita.ac.in/IIT2006117/javasoft/webstart/geekjokes/geekjokes.jnlp] >
    I am glad you got it working! But that launch file is still slightly invalid.
    Here is a corrected, and slightly optimized (you can leave the prefix off the href, if it is the same as the codebase), version of it.
    <?xml version="1.0" encoding="utf-8"?>
    <!-- JNLP File for GeekJokes 0.3 app -->
    <jnlp spec="1.0+"
          codebase="http://profile.iiita.ac.in/IIT2006117/javasoft/webstart/geekjokes"
          href="geekjokes.jnlp">
       <information>
          <title>GeekJokes App</title>
          <vendor>Vaibhav Mishra</vendor>
          <homepage href="http://scjpbeginner.blogspot.com"/>
          <description>Geeky Jokes</description>
          <description kind="short">Cshows random jokes</description>
          <offline-allowed/>
       </information>
       <resources>
           <j2se version="1.6+"
               href="http://java.sun.com/products/autodl/j2se"/>
           <jar href="GeekJokes0.3.jar"/>
       </resources>
       <application-desc main-class="Process"/>
    </jnlp>Very 'Geeky', BTW. ;-)
    Another few things I noted when I looked at it.
    1) There is a stray thread going after the JOptionPane is dismissed. The VM does not end, and the console (if you have it configured to pop-up for JWS apps.) stays on-screen.
    2) If all the jokes are prefixed by '* ' I would recommend removing it from every line of the source file and either re-adding it at runtime, or (preferably) not adding it at all (since it is redundant).
    3) Reconfigure the app. into a loop, and offer the user a JOptionPane with "Another Joke"/"End" instead of "OK".
    4) You can always remove that debugging line I inserted in the code to show the path to the Jar - it was just intended as a 'sanity check' during testing.
    5) Why is it Java 1.6+? JOptionPane was introduced in Java 1.2 with the first Swing implementations, and the I/O is compatible with Java 1.1.
    >
    Thanks again!!!!>Thanks are best expressed (to me) in the notation of a helpful/correct answer (which you have done), and the assignation of (the remaining) dukes*. ;-)
    * After all - checks the title - we have gotten entirely around those 'security restrictions' in a sandboxed application. The reason being that File objects are rarely the correct choice, for applets or JWS apps.

  • Security restriction in LoginModule?

    I have implemented my own LoginModule. In the module, I try to reference an
    EJB.
    When I call PortableRemoteObject.narrow(), I get the following error:
    java.lang.ClassCastException: Cannot narrow remote object to
    net.lm.uams.service.ejb.UserAccountManagementServiceRemoteHome
    Is this because of some security restriction related to the LoginModule, or
    do you think that the problem stems from having two copies of the same EJB
    classes? If the problem is related to having two copies of the classes, how
    would I go about referencing the classes from the LoginModule without having
    them in that .jar file?
    Note that this problem isn't at weblogic startup - I have written code to
    handle this initial administrator authentication. The problem occurs later
    during form-based authentication. The publicly available pages/EJBs work
    fine.
    using WLS 7.0 on win2000.
    I'd appreciate any pointers.
    thanks
    Sean

    Bill,
    I haven't added anything at all to the classpath in my startup script. WL
    just picks up my jar in WL_HOME/server/lib/mbeantypes. I've done a
    System.getProperty() for the classpath at runtime, and it doesn't include my
    ejb.jar.
    Yesterday, I re-wrote my class to do a straight JDBC lookup to the database
    for username/pwd/roles. It's not the solution I'd prefer, because it
    introduces a reliance on the underlying database schema into the
    LoginModule. But, I don't really have time at the moment to spend
    experimenting with my original idea. Hopefully I can come back to it in the
    future.
    thanks again,
    Sean
    "William Kemp" <[email protected]> wrote in message
    news:[email protected]...
    Each enterprise application has it's own classloader hierarchy, whichmeans the
    ejbs and webapps in an EAR file are loaded by a classloader hierarchy thatis
    parented by the boot, system, and application classloaders that load theboot
    classes, java core classes, and weblogic.jar classes, and any classes thatyou
    put in the classpath when you start weblogic. The EAR file classes areloaded
    below these, hierarchically speaking.
    I am assuming that you have put your LoginModule classfile in the javaclasspath
    when you start the server. Are you perhaps putting the jar file generatedby the
    ejbc process in the java classpath when you start the server, too? Couldyou
    post your start script? Also, remember that the start script that comeswith
    weblogic prepends it's jars and what not to the existing classpath. So,that
    while you may not be explicitly adding the ejb jar file to the classpathin the
    start script, it may be already in the classpath in the currentenvironment and
    the start script is tacking that on at the end.
    Just a guess.
    Bill
    Sean Ryan wrote:
    Thanks for the response William. I have tried what you suggested, but
    the
    problem is still the same.
    If I do the jndi lookup without the narrow() part, I can execute methodson
    the resultant object using reflection. This is a bit of a hack, and not
    really a satisfactory solution.
    I have written a main() method in my class, and when I execute it (fromthe
    .jar), it can do the lookup and narrow without any difficulty.
    As I understand it, each container has its own classloader, however myclass
    is essentially executing from within weblogic. Is there a bit of a greyarea
    here in relation to class loading? Because, as I said my class worksfine
    when it is executing in a separate jvm.
    again, I would appreciate any input you can offer.
    Sean
    "William Kemp" <[email protected]> wrote in message
    news:[email protected]...
    If this was because of a security restriction, you would see a
    different
    Exception. Try putting just the compiled Home and Remote interfaces inthe
    classpath used by the LoginModule and not the jar file with thegenerated
    and
    compiled code for the stubs. You don't need them in the client becuase
    you
    are
    coding to the inteface, not the stubs.
    Bill
    Sean Ryan wrote:
    I have implemented my own LoginModule. In the module, I try to
    reference
    an
    EJB.
    When I call PortableRemoteObject.narrow(), I get the following
    error:
    >>>>
    java.lang.ClassCastException: Cannot narrow remote object to
    net.lm.uams.service.ejb.UserAccountManagementServiceRemoteHome
    Is this because of some security restriction related to theLoginModule,
    or
    do you think that the problem stems from having two copies of the
    same
    EJB
    classes? If the problem is related to having two copies of the
    classes,
    how
    would I go about referencing the classes from the LoginModule
    without
    having
    them in that .jar file?
    Note that this problem isn't at weblogic startup - I have written
    code
    to
    handle this initial administrator authentication. The problem occurslater
    during form-based authentication. The publicly available pages/EJBs
    work
    fine.
    using WLS 7.0 on win2000.
    I'd appreciate any pointers.
    thanks
    Sean

  • Do the security restrictions on applets apply to local applets?

    Hi,
    I read:
    "Current browsers impose the following restrictions on any applet that is loaded over the network:
    An applet cannot load libraries or define native methods.
    It cannot ordinarily read or write files on the host that's executing it.
    It cannot make network connections except to the host that it came from.
    It cannot start any program on the host that's executing it.
    It cannot read certain system properties.
    Windows that an applet brings up look different than windows that an application brings up. "
    What if I have a directoy called "test" on my computer with a *.html site that contains an applet (lets say testApplet.class). Can this applet then establish network connections (for example) or do the security restrictions still apply?

    Any unsigned applet running in a browser is restricted regardless of where it was loaded from. That's just the way it is.
    Either change the program to an application or look into how to "sign" the applet so that it has more freedom.

  • How to load a class dynamically in the current/system class loader

    I need to dynamically load a new jdbc driver jar to the current/system class loader... Please note that creating a new classloader will not help since the DriverManager refers to the systemclassloader itself.
    Restarting the application by appending the jar to its classpath will solve the problem but I want to avoid doing this.

    Did you then create a ClassLoader to load the JDBC
    driver and then install it into the system as
    directed by the JDBC specification (ie
    Class.forName(someClassName))?
    And then try to use it from a class loaded fromsome
    other ClassLoader (i.e. the system class loader)?
    If you did not try this please explain why not.O.K. I just looked at the source to
    java.sql.DriverManager. I did not know what I was
    talking about, as what I suggested above will not
    work.
    This is my new Idea:
    Create a URLClassLoader to load the JDBC driver also
    in this ClassLoader you need to place a helper class
    that does the following:
    public class Helper {
    public Driver getJDBCDriver(String driverClassName,
    String url) {
    try {
    Class.forName(driverClassName);
    Driver d = DriverManager.getDriver(url);
    return d;
    catch(Exception ex) {
    ex.printStackTrace();
    return null;
    }Now create an instance of the Helper class in the new
    ClassLoader, and call its getJDBCDriver method to get
    an instance of the driver (you will probably have to
    create an interface in the root class loader that the
    Helper implements so that you can easily call it).
    Now from the root classloader you can make calls
    directly to the returned Driver and bypass the
    DriverManager and its restrictions on cross
    ClassLoader access.
    The only catch here is that you would have to call to
    the returned Driver directly and not use the Driver
    Manager.This sounds like will work but I did not want to load DriverManager in a new classloader.. I did a hack
    I unzip the jar dynamically in a previously known location (which I included in my classpath when launching the app). The classLoader finds the class now though it did not exist when the app was launched !
    A hack of-course but works eh ..

  • Performance issues with class loader on Windows server

    We are observing some performance issues in our application. We are Using weblogic 11g with Java6 on a windows 2003 server
    The thread dumps indicate many threads are waiting in queue for the native file methods:
    "[ACTIVE] ExecuteThread: '106' for queue: 'weblogic.kernel.Default (self-tuning)'" RUNNABLE
         java.io.WinNTFileSystem.getBooleanAttributes(Native Method)
         java.io.File.exists(Unknown Source)
         weblogic.utils.classloaders.ClasspathClassFinder.getFileSource(ClasspathClassFinder.java:398)
         weblogic.utils.classloaders.ClasspathClassFinder.getSourcesInternal(ClasspathClassFinder.java:347)
         weblogic.utils.classloaders.ClasspathClassFinder.getSource(ClasspathClassFinder.java:316)
         weblogic.application.io.ManifestFinder.getSource(ManifestFinder.java:75)
         weblogic.utils.classloaders.MultiClassFinder.getSource(MultiClassFinder.java:67)
         weblogic.application.utils.CompositeWebAppFinder.getSource(CompositeWebAppFinder.java:71)
         weblogic.utils.classloaders.MultiClassFinder.getSource(MultiClassFinder.java:67)
         weblogic.utils.classloaders.MultiClassFinder.getSource(MultiClassFinder.java:67)
         weblogic.utils.classloaders.CodeGenClassFinder.getSource(CodeGenClassFinder.java:33)
         weblogic.utils.classloaders.GenericClassLoader.findResource(GenericClassLoader.java:210)
         weblogic.utils.classloaders.GenericClassLoader.getResourceInternal(GenericClassLoader.java:160)
         weblogic.utils.classloaders.GenericClassLoader.getResource(GenericClassLoader.java:182)
         java.lang.ClassLoader.getResourceAsStream(Unknown Source)
         javax.xml.parsers.SecuritySupport$4.run(Unknown Source)
         java.security.AccessController.doPrivileged(Native Method)
         javax.xml.parsers.SecuritySupport.getResourceAsStream(Unknown Source)
         javax.xml.parsers.FactoryFinder.findJarServiceProvider(Unknown Source)
         javax.xml.parsers.FactoryFinder.find(Unknown Source)
         javax.xml.parsers.DocumentBuilderFactory.newInstance(Unknown Source)
         org.ajax4jsf.context.ResponseWriterContentHandler.<init>(ResponseWriterContentHandler.java:48)
         org.ajax4jsf.context.ViewResources$HeadResponseWriter.<init>(ViewResources.java:259)
         org.ajax4jsf.context.ViewResources.processHeadResources(ViewResources.java:445)
         org.ajax4jsf.application.AjaxViewHandler.renderView(AjaxViewHandler.java:193)
         org.apache.myfaces.lifecycle.RenderResponseExecutor.execute(RenderResponseExecutor.java:41)
         org.apache.myfaces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:140)
    On googling this seems to be an issue with java file handling on windows servers and I couldn't find a solution yet. Any recommendation or pointer is appreciated

    Hi shubhu,
    I just analyzed your partial Thread Dump data, the problem is that the ajax4jsf framework ResponseWriterContentHandler triggers internally a new instance of the DocumentBuilderFactory; every time; triggering heavy IO contention because of Class loader / JAR file search operations.
    Too many of these IO operations under heavy load will create excessive contention and severe performance degradation; regardless of the OS you are running your JVM on.
    Please review the link below and see if this is related to your problem.. This is a known issue in JBOSS JIRA when using RichFaces / ajaxJSF.
    https://issues.jboss.org/browse/JBPAPP-6166
    Regards,
    P-H
    http://javaeesupportpatterns.blogspot.com/

  • Dinamyc class loading and jar files

    I'm new to java. I would like to load some plugins in my application (it's going to be packaged as a jar at the end). I managed to find some dinamyc class loading examples but they search for the classes to load in a directory.
    This is the code:
        public static void main(String[] args) {
            File pluginDirectory = new File("src/pluginsreloaded/plugins");
            if (!pluginDirectory.exists()) {            // the plugin directory does not exist
                System.out.println("The plugins directory does not exist!");           
                return;
            FilenameFilter filter = new FilenameFilter() {
                public boolean accept(File dir, String name) {
                    return name.endsWith(".class");
            String[] pluginFiles = pluginDirectory.list(filter);
            for (int i = 0; i < pluginFiles.length; i++) {
                if (pluginFiles.indexOf("$") == -1) {
    System.out.println("Loading: " + pluginFiles[i].substring(0, pluginFiles[i].length() - 6));
    IPlugin plugin = pm.loadPlugin(pluginFiles[i].substring(0, pluginFiles[i].length() - 6));
    System.out.println(plugin.description());
    protected static IPlugin loadPlugin(String name) {
            // Query the plugin list for the plugin
            PluginFactory _plugin = (PluginFactory) pluginList.get(name);
            if (_plugin == null) {          // the plugin is not loaded
                try {
                    Class.forName("pluginsReloaded.plugins." + name);
                    // The plugin makes an entry in the plugin list
                    // when loaded
                    _plugin = (PluginFactory) pluginList.get(name);
                    if (_plugin == null) {
                        return null;
                } catch (ClassNotFoundException e) {
                    System.out.println("Plugin " + name + " not found!");
            return _plugin.create();
        }IPlugin is an interface. I am using netbeans 5.0. The error I get is this:
    Exception in thread "main" java.lang.NoClassDefFoundError: pluginsReloaded/plugins/plugin1 (wrong name: pluginsreloaded/plugins/plugin1)
            at java.lang.ClassLoader.defineClass1(Native Method)
            at java.lang.ClassLoader.defineClass(ClassLoader.java:620)
            at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:124)
            at java.net.URLClassLoader.defineClass(URLClassLoader.java:260)
            at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
            at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
            at java.security.AccessController.doPrivileged(Native Method)
            at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
            at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
            at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:268)
            at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
            at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
            at java.lang.Class.forName0(Native Method)
            at java.lang.Class.forName(Class.java:164)
            at pluginsreloaded.PluginManager.loadPlugin(PluginManager.java:30)
            at pluginsreloaded.Main.main(Main.java:44)
    Java Result: 1As far as I can see it can't find the class. My question is how can I load the class/where can I find it?
    Thanks.

    You can use the java.util.jar.JarFile class to enumerate the contents of a jar. It's not good practice to search for plugins in this way though. A plugin may well involve serveral classes, which don't all have to be internal. Furthermore its wise to avoid any comitment about the mechaism by which class files are to be fetched. You might want to do it remotely, some time, or load them from a database.
    What seesms to be the standard approach is to put a list of plugin classes into the jar as a text file.
    Plugins for a given purpose usually implement some specified interface, or extend some abstract class to which their objects can be cast once loaded (without this they aren't really much use).
    Say your plugins implment org.myorg.WidgetFactory then you put a list of them, one fully qualified name to a line, in a file or jar entry called META-INF/services/org.myorg.WidgetFactory. You framework picks up all such files from the classpath using ClassLoader.getResources() and loads all the classes whose names if finds, hence you can add new sets of plugins just by adding a new jar or class directory to the class path.

  • Plz help me out with class loader problem

    hai forum members,
    I have a code which loads class files from local disk.
    It works fine with some classes ,
    But i get this exception when i am selecting certain other class files
    I am using jdeveloper.
    Exception in thread "AWT-EventQueue-0" java.lang.NoClassDefFoundError: Filter (wrong name: project1/Filter)
         at java.lang.ClassLoader.defineClass1(Native Method)
         at java.lang.ClassLoader.defineClass(ClassLoader.java:620)
         at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:124)
         at java.net.URLClassLoader.defineClass(URLClassLoader.java:260)
         at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
         at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
         at java.security.AccessController.doPrivileged(Native Method)
         at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
         at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
         at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
         at com.jutframe.JavaUnitTester.selectClass_actionPerformed(JavaUnitTester.java:449)
         at com.jutframe.JavaUnitTester$7.actionPerformed(JavaUnitTester.java:338)
         at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1849)
         at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2169)
         at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:420)
         at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:258)
         at javax.swing.AbstractButton.doClick(AbstractButton.java:302)
         at javax.swing.plaf.basic.BasicMenuItemUI.doClick(BasicMenuItemUI.java:1000)
         at javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(BasicMenuItemUI.java:1041)
         at java.awt.Component.processMouseEvent(Component.java:5488)
         at javax.swing.JComponent.processMouseEvent(JComponent.java:3093)
         at java.awt.Component.processEvent(Component.java:5253)
         at java.awt.Container.processEvent(Container.java:1966)
         at java.awt.Component.dispatchEventImpl(Component.java:3955)
         at java.awt.Container.dispatchEventImpl(Container.java:2024)
         at java.awt.Component.dispatchEvent(Component.java:3803)
         at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4212)
         at java.awt.LightweightDispatcher.processMouseEvent(Container.java:3892)
         at java.awt.LightweightDispatcher.dispatchEvent(Container.java:3822)
         at java.awt.Container.dispatchEventImpl(Container.java:2010)
         at java.awt.Window.dispatchEventImpl(Window.java:1766)
         at java.awt.Component.dispatchEvent(Component.java:3803)
         at java.awt.EventQueue.dispatchEvent(EventQueue.java:463)
         at java.awt.EventDispatchThread.pumpOneEventForHierarchy(EventDispatchThread.java:234)
         at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:163)
         at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:157)
         at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:149)
         at java.awt.EventDispatchThread.run(EventDispatchThread.java:110)
                        JFileChooser jfilechooser=new JFileChooser();
                        Filterclass filter=new Filterclass();
                        //Set selection mode for file chooser
                        jfilechooser.setFileSelectionMode(JFileChooser.FILES_ONLY);
                        //set file filter
                        jfilechooser.setFileFilter(filter);
                        int returnVal = jfilechooser.showOpenDialog(this);
                        if(returnVal == JFileChooser.APPROVE_OPTION)
                            try
                                    String str = jfilechooser.getSelectedFile().getName();
                                    String parent=jfilechooser.getSelectedFile().getParent();
                                     // Create a File object on the root of the directory containing the class file
                                     File file = new File(parent);
                                     // Convert File to a URL
                                     URL url = file.toURL();         
                                     URL[] urls = new URL[]{url};
                                     // Create a new class loader with the directory
                                     ClassLoader cl = new URLClassLoader(urls);
                                     StringTokenizer st = new StringTokenizer(str,".");
                                     String s = st.nextToken ();
                                     Class c = cl.loadClass(s);  //ERROR IS SHOWN IN THIS PARTICULAR LINE
                                     Object instance=c.newInstance();
    --------------------------------------------please help me trace my mistake.
    thank you all.

    i think the problem that i have set a particular class path for my class files and my application loads files from that alone.
    So plz tell me if theres any way to access the class path of a particular file dynamically?
    regards

  • Dynamic class loading problem using unknown JAR archive and directory names

    I read the following article, which enlightened me a lot:
    Ted Neward: Understanding Class.forName().
    However, it took me some while to understand that my problem is the other way around:
    I know the name of the class, I know the name of the method,
    but my program/JVM does not know where to load the classes from.
    Shortly, my problem is that the server engine that I am writing
    uses two different versions of the same library.
    So I am trying out the following solution:
    My program is named TestClassPathMain.java
    Assume the two libraries are named JAR1.jar and JAR2.jar
    and the class/instance method that should
    be exposed to TestClassPathMain.java by them is named
    TestClass1.testMethod().
    As long as I was depending on just one library,
    I put JAR1.jar in the classpath before starting java,
    and I was happy for a while.
    At the moment I got the need to use another version of
    TestClass1.testMethod() packaged in JAR2.jar,
    a call would always access JAR1.jar's
    TestClass1.testMethod().
    I then decided to remove JAR1.jar from the classpath,
    and programmatically define two separate ClassLoaders, one for use
    with JAR1.jar and the other for use with JAR2.jar.
    However, the problem is only partly solved.
    Please refer to the enclosed code for details.
    (The code in the JAR1.jar/JAR2.jar is extremely simple,
    it just tells (by hardcoding) the name of the jar it is packaged in
    and instantiates another class packaged in the same jar using
    the "new" operator and calls a method on it. I don't enclose it.)
    The TestClassPathMain.java/UC1.java/UC2.java code suite was
    successfully compiled with an arbitrary of JAR1 or JAR2 in the classpath,
    however removed from the classpath at runtime.
    (I know that this could have been done (more elegantly...?) by producing an Interface,
    but I think the main problem principle is still untouched by this potential lack of elegancy(?))
    1) This problem should not be unknown to you experts out there,
    how is it generally and/or most elegantly solved?
    The "*** UC2: Variant 2" is the solution I would like best, had it only worked.
    2) And why arent "*** UC2: Variant 2" and
    "*** static UC2: Variant 2" working,
    while "*** Main: Variant 2" is?
    3) And a mal-apropos:
    Why can't I catch the NoClassDefFoundError?
    The output:
    *** Main: Variant 1 JAR 1 ***:
    Entering TestClass1.testMethod() packaged in JAR1.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR1.jar
    *** Main: Variant 1 JAR 2 ***:
    Entering TestClass1.testMethod() packaged in JAR2.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR2.jar
    *** Main: Variant 2 JAR 1 ***:
    Entering TestClass1.testMethod() packaged in JAR1.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR1.jar
    *** Main: Variant 2 JAR 2 ***:
    Entering TestClass1.testMethod() packaged in JAR2.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR2.jar
    *** UC1: Variant 1 JAR 1 ***:
    Entering TestClass1.testMethod() packaged in JAR1.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR1.jar
    *** UC1: Variant 1 JAR 2 ***:
    Entering TestClass1.testMethod() packaged in JAR2.jar
    About to instantiate TestClass2 with the new operator
    About to call TestClass2.testMethod()
    Entering TestClass2.testMethod() packaged in JAR2.jar
    *** static UC2: Variant 2 JAR 1 ***:
    Exception in thread "main" java.lang.NoClassDefFoundError: TestClass1
            at UC2.runFromJarVariant2_static(UC2.java:56)
            at TestClassPathMain.main(TestClassPathMain.java:52)
    TestClassPathMain.java
    import java.lang.reflect.InvocationTargetException;
    import java.lang.reflect.Method;
    import java.net.MalformedURLException;
    import java.net.URL;
    import java.net.URLClassLoader;
    public class TestClassPathMain {
        public static void main(final String args[]) throws MalformedURLException, ClassNotFoundException, InstantiationException, SecurityException, NoSuchMethodException, IllegalArgumentException, IllegalAccessException, InvocationTargetException {
                // Commented out because I cannot catch the NoClassDefFoundError.
                // Why?
                try {
                    final TestClass1 testClass1 = new TestClass1();
                    System.out.println(
                        "\nThe class TestClass1 is of some unexplicable reason available." +
                        "\nFor the purpose of the test, it shouldn't have been!" +
                        "\nExiting");
                    System.exit(1);
                } catch (NoClassDefFoundError e) {
                    System.out.println("\nPositively confirmed that the class TestClass1 is not available:\n" + e);
                    System.out.println("\n\nREADY FOR THE TEST: ...");
                // Works fine
                System.out.println("\n*** Main: Variant 1 JAR 1 ***:");
                runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP1/JAR1.jar");
                System.out.println("\n*** Main: Variant 1 JAR 2 ***:");
                runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP2/JAR2.jar");
                // Works fine
                System.out.println("\n*** Main: Variant 2 JAR 1 ***:");
                runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP1/JAR1.jar");
                System.out.println("\n*** Main: Variant 2 JAR 2 ***:");
                runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP2/JAR2.jar");
                // Works fine
                final UC1 uc1 = new UC1();
                System.out.println("\n*** UC1: Variant 1 JAR 1 ***:");
                uc1.runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP1/JAR1.jar");
                System.out.println("\n*** UC1: Variant 1 JAR 2 ***:");
                uc1.runFromJarVariant1("file:/W:/java/eclipse/workspaces/simped_test/CP2/JAR2.jar");
                // Crashes
                System.out.println("\n*** static UC2: Variant 2 JAR 1 ***:");
                UC2.runFromJarVariant2_static("file:/W:/java/eclipse/workspaces/simped_test/CP1/JAR1.jar");
                System.out.println("\n*** static UC2: Variant 2 JAR 2 ***:");
                UC2.runFromJarVariant2_static("file:/W:/java/eclipse/workspaces/simped_test/CP2/JAR2.jar");
                // Crashes
                final UC2 uc2 = new UC2();
                System.out.println("\n*** UC2: Variant 2 JAR 1 ***:");
                uc2.runFromJarVariant2("file:/W:/java/eclipse/workspaces/simped_test/CP1/JAR1.jar");
                System.out.println("\n*** UC2: Variant 2 JAR 2 ***:");
                uc2.runFromJarVariant2("file:/W:/java/eclipse/workspaces/simped_test/CP2/JAR2.jar");
        private static void runFromJarVariant1(final String jarFileURL)
            throws MalformedURLException,
                   ClassNotFoundException,
                   InstantiationException,
                   IllegalArgumentException,
                   IllegalAccessException,
                   InvocationTargetException,
                   SecurityException,
                   NoSuchMethodException {
            final URL url = new URL(jarFileURL);
            final URLClassLoader cl =
                new URLClassLoader(new URL[]{url},
                                   Thread.currentThread().getContextClassLoader());
            final Class clazz = cl.loadClass("TestClass1");
            final Object testClass1 = clazz.newInstance();
            final Method testMethod1 = clazz.getMethod("testMethod", null);
            testMethod1.invoke(testClass1, null);
        private static void runFromJarVariant2(final String jarFileURL)
            throws MalformedURLException,
                   ClassNotFoundException,
                   InstantiationException,
                   IllegalArgumentException,
                   IllegalAccessException,
                   InvocationTargetException,
                   SecurityException,
                   NoSuchMethodException {
            final URL url = new URL(jarFileURL);
            final URLClassLoader cl =
                new URLClassLoader(new URL[]{url},
                                   Thread.currentThread().getContextClassLoader());
            final Class clazz = cl.loadClass("TestClass1");
            final TestClass1 testClass1 = new TestClass1();
            testClass1.testMethod();
    UC1.java
    import java.lang.reflect.InvocationTargetException;
    import java.lang.reflect.Method;
    import java.net.MalformedURLException;
    import java.net.URL;
    import java.net.URLClassLoader;
    public class UC1 {
        public void runFromJarVariant1(final String jarFileURL)
            throws MalformedURLException,
                   ClassNotFoundException,
                   InstantiationException,
                   IllegalArgumentException,
                   IllegalAccessException,
                   InvocationTargetException,
                   SecurityException,
                   NoSuchMethodException {
            final URL url = new URL(jarFileURL);
            final URLClassLoader cl =
                new URLClassLoader(new URL[]{url},
                                   Thread.currentThread().getContextClassLoader());
            final Class clazz = cl.loadClass("TestClass1");
            final Object testClass1 = clazz.newInstance();
            final Method testMethod1 = clazz.getMethod("testMethod", null);
            testMethod1.invoke(testClass1, null);
    UC2.java
    import java.lang.reflect.InvocationTargetException;
    import java.net.MalformedURLException;
    import java.net.URL;
    import java.net.URLClassLoader;
    public class UC2 {
        public void runFromJarVariant2(final String jarFileURL)
        throws MalformedURLException,
               ClassNotFoundException,
               InstantiationException,
               IllegalArgumentException,
               IllegalAccessException,
               InvocationTargetException,
               SecurityException,
               NoSuchMethodException {
            final URL url = new URL(jarFileURL);
            final URLClassLoader cl =
                new URLClassLoader(new URL[]{url},
                                   Thread.currentThread().getContextClassLoader());
            final Class clazz = cl.loadClass("TestClass1");
            final TestClass1 testClass1 = new TestClass1();
            testClass1.testMethod();
         * Identic to the "runFromJarVariant2" method,
         * except that it is static
        public static void runFromJarVariant2_static(final String jarFileURL)
        throws MalformedURLException,
               ClassNotFoundException,
               InstantiationException,
               IllegalArgumentException,
               IllegalAccessException,
               InvocationTargetException,
               SecurityException,
               NoSuchMethodException {
            final URL url = new URL(jarFileURL);
            final URLClassLoader cl =
                new URLClassLoader(new URL[]{url},
                                   Thread.currentThread().getContextClassLoader());
            final Class clazz = cl.loadClass("TestClass1");
            final TestClass1 testClass1 = new TestClass1();
            testClass1.testMethod();
    }

    2. i need to load the class to the same JVM (i.e. to
    the same environment) of the current running
    aplication, so that when the loaded class is run, it
    would be able to invoke methods on it!!!
    ClassLoader(s) do this. Try the URLClassLoader.
    (I was talking about relatively esoteric "security"
    issues when I mentioned the stuff about Class objects
    "scope".) You might use the URLClassLoader kind of
    like this.
    Pseudo-code follows:
    // setup the class loader
    URL[] urls = new URL[1];
    urls[0] = new URL("/path/to/dynamic/classes");
    URLClassLoader ucl = new URLClassLoader(urls);
    // load a class & use make an object with the default constructor
    Object tmp = ucl.loadClass("dynamic.class.name").newInstance();
    // Cast the object to a know interface so that you can use it.
    // This may be used to further determine which interface to cast
    // the class to. Or it may simply be the interface to which all
    // dynamic classes have to conform in your program.
    InterfaceImplementedByDynamicClass loadedObj =
        (InterfaceImplementedByDynamicClass)tmp;It's really not as hard as it sounds, just write a little test of
    this and you will see how it works.

Maybe you are looking for