Two 3rd party jars share common class, signed differently

hi,
i have struck a problem where a SecurityException is thrown because two third party jars that are signed contain a class common to a package.
Jar A:
com.sun.xml.util.XmlChars
Jar B:
com.sun.xml.util.XmlChars
com.sun.xml.util.MessageCatalog
com.sun.xml.util.SomethingSomething
I can't touch Jar A, but Jar B can be edited. Since the security granularity seems to be a package level according to the error message, deleting XmlChars from Jar B doesn't work since both jars still contain classes from the same package.
Jar B does need the MessageCatalog so I can't remove it. I can only think of two options from here
1) find a Jar signed by the A people (JAXB) that contains the extra classes
2) some clever trick with classloaders - but I'm not sure what the issues are here..
any help would be deeply appreciated,
thanks,
asjf

2) some clever trick with classloaders - but I'm not sure what the issues are here..well, just loading class B and its associates in a new classloader is allowing this to work. I think this is safe too. Would be interested if anyone knows more about this area - eg. what if B needed to access something in A or vice versa, or both ways simultaneously?
thanks,
asjf

Similar Messages

Common 3rd Party Jars in an EAR

Hi
I have some common 3rd party jars and zips that are accessed by my WARs and EJB
JARs. Where in my EAR structure do i place them so that these common jars like
classes12, formulaone etc can be accessed from within my WARs and EJB jars?
Regards
Sudhindra

Just place them at the root level of the .ear and mention them in the
Class-Path entry of the .war manifest.
In article <3e701ee8$[email protected]>, [email protected]
says...
>
Hi
I have some common 3rd party jars and zips that are accessed by my WARs and EJB
JARs. Where in my EAR structure do i place them so that these common jars like
classes12, formulaone etc can be accessed from within my WARs and EJB jars?
Regards
Sudhindra

Signing of 3rd Party jars

I have developed an app which uses Java Web Start. I created a self signed certificate for now an that works fine.
What I was wondering about was 3rd party jars. Are they responsible for their own signing if they do system or disk I/O? Do I need to contact the vendor to get a signed version? I don't think I should be signing someone elses archive files.
I need to run with all permissons set.

My understanding is that if you sign one jar, you need
to sign them all (and with the same certificate).This is only true within the the same jnlp file - not within the whole app.
You can factor out sets of jar files into component extenions (a seperate jnlp file referenced by the original jnlp file.)
Each component extension can have or not have the all-permissions tag, and if it does, the set of jar files in it can be signed by the same or a diferent certificate chain than the original.
/Dietz

3rd party jars/zips in EAR

Hi
I have some common 3rd party jars and zips that are accessed by my WARs and EJB
JARs. Where in my EAR structure do i place them so that these common jars like
classes12, formulaone etc can be accessed from within my WARs and EJB jars?
Regards Sudhindra

http://www.jcp.org
Cheers
mbg
"joe" <[email protected]> wrote in message news:[email protected]..
>
what do you mean by "to integrate this back into the specifications"? whatis the
J2EE way to achieve it if there is one? Thanks
"Mark Griffith" <[email protected]> wrote:
Nope, embrace and extend. We are working to integrate this back into
the
specifications.
cheers
mbg
"Joe" <[email protected]> wrote in message
news:3e77c70d$[email protected]..
Is that part of J2EE or weblogic's implementation?
"Mark Griffith" <[email protected]> wrote:
Upgrade to 8.1 and stick the jar's in myEar/APP-INF/lib
cheers
mbg
"Jen" <[email protected]> wrote in message
news:3e724f46$[email protected]..
Is there a way to put in one shot instead of modifying every .jar
and
..war's manifest
file.
Philip Strube <[email protected]> wrote:
Hi Sudhindra,
you can put them in your EAR (on top level or you can create a
directory
for them, like "libs" or sth.), and then create class-path entriesin
the manifest files of your WAR and ejb-jars.
Example: if myApp.war needs myUtil.jar, then write a line
Class-Path: myUtil.jar
in the manifest file of myApp.war. If myUtil.jar is in libs, write
libs/myUtil.jar and so on.
-- Philip
Sudhindra wrote:
Hi
I have some common 3rd party jars and zips that are accessed
by
my
WARs and EJB
JARs. Where in my EAR structure do i place them so that these
common
jars like
classes12, formulaone etc can be accessed from within my WARs
and
EJB
jars?
Regards Sudhindra

Accessing 3rd party jars from ear.

I was able to create a war with the 3rd party jars in webinf/lib, register it with weblogic and access them from webapps another ear, after specifying this reference in EACH of the webapps.
However if I want to just make the ear reference these jars, ie., all the webapps in the ear access these jars, without individually specifying the reference, then it gives me an error.
What is different with providing a reference from an EAR ? I added it to the weblogic-application.xml as the docs suggested....

http://www.jcp.org
Cheers
mbg
"joe" <[email protected]> wrote in message news:[email protected]..
>
what do you mean by "to integrate this back into the specifications"? whatis the
J2EE way to achieve it if there is one? Thanks
"Mark Griffith" <[email protected]> wrote:
Nope, embrace and extend. We are working to integrate this back into
the
specifications.
cheers
mbg
"Joe" <[email protected]> wrote in message
news:3e77c70d$[email protected]..
Is that part of J2EE or weblogic's implementation?
"Mark Griffith" <[email protected]> wrote:
Upgrade to 8.1 and stick the jar's in myEar/APP-INF/lib
cheers
mbg
"Jen" <[email protected]> wrote in message
news:3e724f46$[email protected]..
Is there a way to put in one shot instead of modifying every .jar
and
..war's manifest
file.
Philip Strube <[email protected]> wrote:
Hi Sudhindra,
you can put them in your EAR (on top level or you can create a
directory
for them, like "libs" or sth.), and then create class-path entriesin
the manifest files of your WAR and ejb-jars.
Example: if myApp.war needs myUtil.jar, then write a line
Class-Path: myUtil.jar
in the manifest file of myApp.war. If myUtil.jar is in libs, write
libs/myUtil.jar and so on.
-- Philip
Sudhindra wrote:
Hi
I have some common 3rd party jars and zips that are accessed
by
my
WARs and EJB
JARs. Where in my EAR structure do i place them so that these
common
jars like
classes12, formulaone etc can be accessed from within my WARs
and
EJB
jars?
Regards Sudhindra

Applets and 3rd party jars

Hi,
I'm trying to use a 3rd party jar with an applet. I can access the functions just fine when using an applet viewer, but when I try deploying the applet from a web page I get classNotFound exceptions. How do I go about getting the applet to recognize the jar file?
Thanks

Eva, yes, if that class in one of the 3rd party jars wants to access your class directly, then it is necessary that your class is loaded by the same classloader that loads that 3rd party jar or even higher up the classloader hierarchy.
Why do you consider putting your class library into applib "a bit rude"? As long as your classes are named distinctively so that they will not clash with other classes, it is not a problem.
On the other hand, it seems that the design of that 3rd party class is not classloader friendly. Had it used something like the following to load a class that is undefined at the compile time, you might not have this problem.
Class userClass = Thread.currentThread().getContextClassLoader().loadClass(nameOfUserDevelopedClass);
Object plugin = userClass.newInstance();

Problem deploying new version of 3rd party jar

I have a third party jar file that was recently updated with to a new version. I deleted the old jar file and replaced it with the new version. Modified classpath accordingly. The strange thing is that the only way I could get the classes that use this jar file to work was to recompile them. What am I missing?

When replacing a jar file it is alway a good idea to recompile against it... this ensures backward compatibity and also prevents Incompatible Class Change Errors. Your new 3rd party jar may not be completely backwards compatible, although it is always a good idea to recompile when implementing a new jar that your application depends on.

How to make the ear file including the 3rd party jar files without menttion in the System Classpath.

Hai Sir,
I am facing one problme in weblogic8.1 while depolying the .EAR FILE.
Please help me sir.
Case1)     1) I am using the struts and log4j frameworks and 3rd party jar files with
weblogic8.1.
     2) I make the ejbs,webapplications and 3rdparty jar files, ear file the following
dir structure .And i mentioned the Class-path including all jar files in the MANIFEST
OF EAR FILE.
     While deploying the ear file it is giving following error.If log4j.jar does not
mention in the Weblogic script file
     java.lang.NoClassDefFoundError: org/apache/log4j/Priority
at java.lang.Class.getDeclaredFields0(Native Method)
at java.lang.Class.privateGetDeclaredFields(Class.java:1494)
at java.lang.Class.getDeclaredFields(Class.java:1073)
at weblogic.ejb20.deployer.EJBModule.disableImplClassLoader(EJBModule.java:1082)
at weblogic.ejb20.deployer.EJBModule.setupEJBToImplClassDependencies(EJBModule.jav
a:982)
at weblogic.ejb20.deployer.EJBModule.prepare(EJBModule.java:419)
at weblogic.j2ee.J2EEApplicationContainer.prepareModule(J2EEApplicationContainer.j
ava:2792)
at weblogic.j2ee.J2EEApplicationContainer.prepareModules(J2EEApplicationContainer.
java:1478)
at weblogic.j2ee.J2EEApplicationContainer.prepare(J2EEApplicationContainer.java:11
36)
at weblogic.j2ee.J2EEApplicationContainer.prepare(J2EEApplicationContainer.java:97
5)
at weblogic.management.deploy.slave.SlaveDeployer$ComponentActivateTask.prepareCon
tainer(SlaveDeployer.java:2571)
at weblogic.management.deploy.slave.SlaveDeployer$ActivateTask.createContainer(Sla
veDeployer.java:2523)
at weblogic.management.deploy.slave.SlaveDeployer$ActivateTask.prepare(SlaveDeploy
er.java:2453)
at weblogic.management.deploy.slave.SlaveDeployer.processPrepareTask(SlaveDeployer
.java:820)
at weblogic.management.deploy.slave.SlaveDeployer.prepareDelta(SlaveDeployer.java:
536)
at weblogic.management.deploy.slave.SlaveDeployer.prepareUpdate(SlaveDeployer.java
:494)
at weblogic.drs.internal.SlaveCallbackHandler$1.execute(SlaveCallbackHandler.java:
25)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:178)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:151)
Please provide the soluation without mentioning classpath in the weblogic script
.How to make the EAR file incliding ejbjar,webapplication and 3rd party jar files.
Thanks & Regards,
ASHOK SAMRAT
[email protected]

Refer to the section
Handling Utility classes
http://dev2dev.bea.com/products/wlserver/articles/musser.jsp
thanks,
Deepak
"Ashok Samrat" <[email protected]> wrote:
>
Hai Sir,
I am facing one problme in weblogic8.1 while depolying the .EAR FILE.
Please help me sir.
Case1)     1) I am using the struts and log4j frameworks and 3rd party jar
files with
weblogic8.1.
     2) I make the ejbs,webapplications and 3rdparty jar files, ear file
the following
dir structure .And i mentioned the Class-path including all jar files
in the MANIFEST
OF EAR FILE.
     While deploying the ear file it is giving following error.If log4j.jar
does not
mention in the Weblogic script file
     java.lang.NoClassDefFoundError: org/apache/log4j/Priority
at java.lang.Class.getDeclaredFields0(Native Method)
at java.lang.Class.privateGetDeclaredFields(Class.java:1494)
at java.lang.Class.getDeclaredFields(Class.java:1073)
at weblogic.ejb20.deployer.EJBModule.disableImplClassLoader(EJBModule.java:1082)
at weblogic.ejb20.deployer.EJBModule.setupEJBToImplClassDependencies(EJBModule.jav
a:982)
at weblogic.ejb20.deployer.EJBModule.prepare(EJBModule.java:419)
at weblogic.j2ee.J2EEApplicationContainer.prepareModule(J2EEApplicationContainer.j
ava:2792)
at weblogic.j2ee.J2EEApplicationContainer.prepareModules(J2EEApplicationContainer.
java:1478)
at weblogic.j2ee.J2EEApplicationContainer.prepare(J2EEApplicationContainer.java:11
36)
at weblogic.j2ee.J2EEApplicationContainer.prepare(J2EEApplicationContainer.java:97
5)
at weblogic.management.deploy.slave.SlaveDeployer$ComponentActivateTask.prepareCon
tainer(SlaveDeployer.java:2571)
at weblogic.management.deploy.slave.SlaveDeployer$ActivateTask.createContainer(Sla
veDeployer.java:2523)
at weblogic.management.deploy.slave.SlaveDeployer$ActivateTask.prepare(SlaveDeploy
er.java:2453)
at weblogic.management.deploy.slave.SlaveDeployer.processPrepareTask(SlaveDeployer
.java:820)
at weblogic.management.deploy.slave.SlaveDeployer.prepareDelta(SlaveDeployer.java:
536)
at weblogic.management.deploy.slave.SlaveDeployer.prepareUpdate(SlaveDeployer.java
:494)
at weblogic.drs.internal.SlaveCallbackHandler$1.execute(SlaveCallbackHandler.java:
25)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:178)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:151)
Please provide the soluation without mentioning classpath in the weblogic
script
How to make the EAR file incliding ejbjar,webapplication and 3rd party
jar files.
Thanks & Regards,
ASHOK SAMRAT
[email protected]

How can I include 3rd party jar files with my custom extention?

I'm writing an extension that is dependent upon some 3rd party jars. How can I include/package these with my extension?
we're using the 11g tech preview
thanks,
Dylan

Do you mean that you need these files to appear in JDeveloper as a library available for the developers who build a project and use your extension?
You can create a library in JDeveloper with JAR files by simply adding the following to your extension.xml file:
<jdeveloper-hook xmlns="http://xmlns.oracle.com/jdeveloper/1013/extension">
- <libraries xmlns="http://xmlns.oracle.com/jdeveloper/1013/jdev-libraries">
<library name="My Extension Library">
<classpath> ${ide.extension.install.home}/lib/some.jar</classpath>
</library>
</jdeveloper-hook>

Classpath and 3rd party jar files

We have been searching for a long time and have not been able to find an answer to our question. Do you think that you could help us out?
We need to include 3rd party jar files in our application. Where in the deployment classpath directory structure can we place these. This does not seem to happen when we publish.
We also need to give our clients the ability to modify our configuration. Currently we do this with an xml file, which we place under server/config in our JBoss directory. We also need to find a home for out log4J configuration file.
Where does this type of thing exist in the SAP world?

We have had problems with 3rd party jar files also. We ended up including them in the WEB-INF/lib directory of our WAR file and packaging/deploying them everytime.
If you are looking for your project on your server, it is deployed to a directory similar to this:
/usr/sap/J01/JC00/j2ee/cluster/server0/apps
Hope this helps.
Chris

How to include 3rd party jar package in the native code aiming to generate ane for android

in my native java code,i need to reference a class in another jar package.Simply to say,i want to make use of member functions of a class of some jar package A in the call function of the native class which have implemented the FREFunction class.To generate the native extension,native java code needs to be compiled to a jar package B.i have tried serveral methods to compile jar package A into B.Howerver my flex project failed to proceed when calling function of package A in the call function of native java code.To be sure of the correctness of the package A and B,i referenced them in a java project with main function and succeeded. at the same time my other call functions of classes impemented FREFunction work well,Then, why did i fail referencing package A?
in the discussion http://forums.adobe.com/message/3965757, i found the same problem,but i was unable to get a workaround,can anybody give me same help?

Standard Java does not support jars within other jars.
Either re-architect your stuff so jars in jars is eliminated, or write a custom classloader that can load from them, or look into 3rd-party solutions, which you can find by searching the net and these forums.

Creating safe sandbox for 3rd party jars

I'm creating a tool which lets 3rd parties distribute and run their code within my framework. Because I cannot gurauntee the source of various libraries the user decides to run, I cannot prevent malicious code from hacking their systems.
Is there a way for me to limit the capability of the 3rd party classes? I'd like to create a safe sandbox for the classes to play in, but not allow them to read the client's system files, write data outside the sandbox, or otherwise damage the client system.
Can I turn off parts of the VM? If I were to force 3rd parties to inherit from Applet would that limit their use of the client system?

You can extend java.lang.SecurityManager -- the only method you need to override is checkPermission, since all the others thunk to it -- set the SecurityManager using System.setSecurityManager, and run untrusted code in a separate thread only. The Security Manager can check to see if the calling thread is the trusted one; if so, it can grant all permissions, otherwise it can grant only those you want to give.

Where to place 3rd party jars for use with SSPI

I have a question regarding the SSPI. Our custom sspi uses some third party jars
for things such as persistence and caching. Our problem is that the sspi jar
file that is placed in the mbeantypes directory relies on some of these jars,
therefore they must be available at startup. However since we will be installing
the sspi on several different Weblogic 8 servers I do not want to modify each
startup script to explicitly include each jar in the classpath.
Is there a place or a best practice that we can use to allow the sspi find these
libraries? Note: we tried the JAVA_HOME/jre/lib/ext directory which does not
seem to work.

You will need to have them in the classpath
Tony
"tobin" <[email protected]> wrote in message
news:40882da6$[email protected]..
>
I have a question regarding the SSPI. Our custom sspi uses some thirdparty jars
for things such as persistence and caching. Our problem is that the sspijar
file that is placed in the mbeantypes directory relies on some of thesejars,
therefore they must be available at startup. However since we will beinstalling
the sspi on several different Weblogic 8 servers I do not want to modifyeach
startup script to explicitly include each jar in the classpath.
Is there a place or a best practice that we can use to allow the sspi findthese
libraries? Note: we tried the JAVA_HOME/jre/lib/ext directory which doesnot
seem to work.

Using loadjava utility to load a 3rd party jar file

Hi Folks,
    I need to validate if a java class, stored into an Oracle Database, is able to connect to a SQLite database.
    In order to connect to SQLite I'm using the the jar file sqlite-jdbc-3.7.2.jar that I got from https://bitbucket.org/xerial/sqlite-jdbc/downloads
    Then I tried to load the jar file into Oracle Database using the command:
    loadjava -resolve -user system/xpto@tm014_23 -schema novacap sqlite-jdbc-3.7.2.jar
    The result is a series of error messages with the error code ORA-29533.
    Ex: - Attempt to overwrite class or resource org/sqlite/Codes while defining or compiling SYSTEM.org/sqlite/Codes
    Can you guys help me?
Thanks,
Luis

I need to validate if a java class, stored into an Oracle Database, is able to connect to a SQLite database.
You need to explain that a little more.
How could a java class within Oracle connect to a SQLLite database if the driver it needs isn't already loaded into Oracle.
The fact that you have to load the driver jar file tells you that the class will not be able to connect to SQLLite.
The recommended way to develop with 'Java in the database' is to first write and test the code OUTSIDE the database. Then when it works load it in the databse.
So use a copy of the Java class and test it outside the database to see if it can connect.
Also since 11g you could just load that jar as a 'database resident' jar file. If you don't do that then Oracle just extracts all of the files in the jar and tries to load them one at a time. So using 'resolve' won't work because Oracle isn't going to load the classes in the proper order.
See 'database resident jars' in the Java Dev Guide
http://docs.oracle.com/cd/B28359_01/java.111/b31225/chtwo.htm#BEJCBAHI
Database Resident JARs
Starting with 11g release 1 (11.1), when you load the contents of a JAR into the database, you have the option of creating a database object representing the JAR itself. In this way, you can retain an association between this JAR object and the class, resource, and source objects loaded from the JAR. This enables you to:
Use signed JARs and JAR namespace segregation in the same way as you use them in standard JVM.
Manage the classes that you have derived from a JAR while loading it into the database as a single unit. This helps you to prevent individual redefinition of the classes loaded from the JAR. It also enables you to drop the whole set of classes loaded from the JAR, irrespective of the contents or the continued existence of the JAR on the external file system, at the time of dropping it.
In order to load a JAR into the database, you have the following options of the loadjava tool:
-jarsasdbobjects
-prependjarnames
For more information regarding the loadjava tool options, refer to "The loadjava Tool" section.

How to share common classes across multiple projects in Jdeveloper?

Hi Experts,
I have a basic question.
I am using Jdeveloper 11g and have divided my application into 2 projects (Model(ejb's) and Viewcontroller(jsf+managed beans etc)).
The model project has a stateless session bean(named VisitingScholarBean) which uses a java bean class(named VisitingScholarDetails) defined in the ViewController project.
The relevant Method in the stateless session bean is public void saveVSDetails(VisitingScholarDetails vsDetails).
Now the issue is that the VisitingScholarDetails class is part of only the ViewController project but is being used in the Model project.
So when I try to run the application it gives an error saying that
weblogic.application.ModuleException: Exception preparing module: EJBModule(VisitingScholar-Model-ejb)
[EJB:011023]An error occurred while reading the deployment descriptor. The error was:
edu/nyu/ecoms/oaa/vs/web/backing/VisitingScholarDetails.
     at weblogic.ejb.container.deployer.EJBModule.prepare(EJBModule.java:452)
     at weblogic.application.internal.flow.ModuleListenerInvoker.prepare(ModuleListenerInvoker.java:93)
     at weblogic.application.internal.flow.DeploymentCallbackFlow$1.next(DeploymentCallbackFlow.java:387)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:37)
     at weblogic.application.internal.flow.DeploymentCallbackFlow.prepare(DeploymentCallbackFlow.java:58)
     Truncated. see log file for complete stacktrace
java.lang.ClassNotFoundException: edu.nyu.ecoms.oaa.vs.web.backing.VisitingScholarDetails
     at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:283)
     at weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:256)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
     at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
     at weblogic.utils.classloaders.GenericClassLoader.loadClass(GenericClassLoader.java:176)I cannot replicate the same VisitingScholarDetails class in both projects as it will lead to duplication.
Please let me know how to include the VisitingScholarDetails class in the ejb-jar without replicating it in the Model and View Controller projects.
Thanks for your time and help.
Edited by: user10376431 on Jan 24, 2010 6:25 AM

Welcome User in OTN,
to make two projects can access its classes you should goto the project property ---> Dependencies then add the other project.
in your case:
try to goto you Model project property ----> Dependencies ---> Edit Dependencies .
you will find your ViewController project. Expand it thin check to Build Output.
you can make this for ViewContoller project also as:
goto you ViewContoller project property ----> Dependencies ---> Edit Dependencies .
you will find your Model project. Expand it thin check to Build Output.
Sameh Nassar

Two 3rd party jars share common class, signed differently

Similar Messages

Maybe you are looking for