Security Issues when using native Java API in an application server

84 views
Skip to first unread message

Sohail Zahid

unread,
Jan 21, 2015, 7:01:32 PM1/21/15
to orient-...@googlegroups.com
Environment
JDK: 1.8
Development environment: Netbeans on Windows
Application Server: Glassfish 4
JEE: 7.x  (using JSF & EJB)


After installing the server (v 2.0), I created a small Java app to connect to OrientDB and voila it works and I was able to connect from the console application.

Then I used the same code in a Web App to connect to the server but I got "JACC Policy Provider: Failed Permission Check".  Confused as to why all help is appreciated.

First I have the code in EJB calling to open a connection and this is where I get a failure:

db = new ODatabaseDocumentTx("remote:localhost/social").open("admin", "admin");

This works fine in console app but fails in Java web app.  Below is details of the exception:

Info:   JACC Policy Provider: Failed Permission Check, context(ws/ws)- permission(("java.lang.RuntimePermission" "accessClassInPackage.jdk.nashorn.internal.runtime.linker"))
Info:   JACC Policy Provider: Failed Permission Check, context(ws/ws)- permission(("java.lang.RuntimePermission" "shutdownHooks"))
Severe:   Error Rendering View[/index.xhtml]
javax.el.ELException: /index.xhtml: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
    at com.sun.faces.facelets.compiler.TextInstruction.write(TextInstruction.java:90)
    at com.sun.faces.facelets.compiler.UIInstructions.encodeBegin(UIInstructions.java:82)
    at com.sun.faces.facelets.compiler.UILeaf.encodeAll(UILeaf.java:183)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
    at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:456)
    at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:133)
    at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:337)
    at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:120)
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
    at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:219)
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:647)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:323)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:321)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
    at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:356)
    at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:214)
    at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1676)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:318)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:160)
    at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:734)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:673)
    at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:99)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:174)
    at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:415)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:282)
    at com.sun.enterprise.v3.services.impl.ContainerMapper$HttpHandlerCallable.call(ContainerMapper.java:459)
    at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:167)
    at org.glassfish.grizzly.http.server.HttpHandler.runService(HttpHandler.java:201)
    at org.glassfish.grizzly.http.server.HttpHandler.doHandle(HttpHandler.java:175)
    at org.glassfish.grizzly.http.server.HttpServerFilter.handleRead(HttpServerFilter.java:235)
    at org.glassfish.grizzly.filterchain.ExecutorResolver$9.execute(ExecutorResolver.java:119)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeFilter(DefaultFilterChain.java:284)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeChainPart(DefaultFilterChain.java:201)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.execute(DefaultFilterChain.java:133)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.process(DefaultFilterChain.java:112)
    at org.glassfish.grizzly.ProcessorExecutor.execute(ProcessorExecutor.java:77)
    at org.glassfish.grizzly.nio.transport.TCPNIOTransport.fireIOEvent(TCPNIOTransport.java:561)
    at org.glassfish.grizzly.strategies.AbstractIOStrategy.fireIOEvent(AbstractIOStrategy.java:112)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.run0(WorkerThreadIOStrategy.java:117)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.access$100(WorkerThreadIOStrategy.java:56)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy$WorkerThreadRunnable.run(WorkerThreadIOStrategy.java:137)
    at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:565)
    at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:545)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.jboss.weld.exceptions.WeldException: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.invokeMethods(DefaultLifecycleCallbackInvoker.java:100)
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.postConstruct(DefaultLifecycleCallbackInvoker.java:81)
    at org.jboss.weld.injection.producer.BasicInjectionTarget.postConstruct(BasicInjectionTarget.java:114)
    at org.jboss.weld.injection.producer.BeanInjectionTarget.postConstruct(BeanInjectionTarget.java:70)
    at org.jboss.weld.bean.ManagedBean.create(ManagedBean.java:153)
    at org.jboss.weld.context.AbstractContext.get(AbstractContext.java:96)
    at org.jboss.weld.manager.BeanManagerImpl.getReference(BeanManagerImpl.java:740)
    at org.jboss.weld.el.AbstractWeldELResolver.lookup(AbstractWeldELResolver.java:107)
    at org.jboss.weld.el.AbstractWeldELResolver.getValue(AbstractWeldELResolver.java:90)
    at javax.el.CompositeELResolver.getValue(CompositeELResolver.java:188)
    at com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:176)
    at com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:203)
    at com.sun.el.parser.AstIdentifier.getValue(AstIdentifier.java:116)
    at com.sun.el.parser.AstValue.getBase(AstValue.java:151)
    at com.sun.el.parser.AstValue.getValue(AstValue.java:200)
    at com.sun.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:226)
    at org.jboss.weld.el.WeldValueExpression.getValue(WeldValueExpression.java:50)
    at com.sun.faces.facelets.el.ELText$ELTextVariable.writeText(ELText.java:238)
    at com.sun.faces.facelets.compiler.TextInstruction.write(TextInstruction.java:85)
    ... 49 more
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.invokeMethods(DefaultLifecycleCallbackInvoker.java:98)
    ... 67 more
Caused by: java.lang.ExceptionInInitializerError
    at com.orientechnologies.orient.core.serialization.serializer.record.string.ORecordSerializerStringAbstract.<clinit>(ORecordSerializerStringAbstract.java:47)
    at com.orientechnologies.orient.core.serialization.serializer.record.ORecordSerializerFactory.<init>(ORecordSerializerFactory.java:40)
    at com.orientechnologies.orient.core.serialization.serializer.record.ORecordSerializerFactory.<clinit>(ORecordSerializerFactory.java:32)
    at com.orientechnologies.orient.core.db.document.ODatabaseDocumentTx.<clinit>(ODatabaseDocumentTx.java:58)
    at com.szcommerce.ws.controller.OrientdbController.init(OrientdbController.java:28)
    ... 72 more
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "shutdownHooks")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:457)
    at java.security.AccessController.checkPermission(AccessController.java:884)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at java.lang.Runtime.addShutdownHook(Runtime.java:209)
    at com.orientechnologies.orient.core.OrientShutdownHook.<init>(OrientShutdownHook.java:20)
    at com.orientechnologies.orient.core.Orient.startup(Orient.java:125)
    at com.orientechnologies.orient.core.Orient.<init>(Orient.java:76)
    at com.orientechnologies.orient.core.Orient.<clinit>(Orient.java:53)
    ... 77 more

FATAL:   JSF1073: javax.el.ELException caught during processing of RENDER_RESPONSE 6 : UIComponent-ClientId=, Message=/index.xhtml: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
FATAL:   /index.xhtml: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
javax.el.ELException: /index.xhtml: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
    at com.sun.faces.facelets.compiler.TextInstruction.write(TextInstruction.java:90)
    at com.sun.faces.facelets.compiler.UIInstructions.encodeBegin(UIInstructions.java:82)
    at com.sun.faces.facelets.compiler.UILeaf.encodeAll(UILeaf.java:183)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1859)
    at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:456)
    at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:133)
    at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:337)
    at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:120)
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
    at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:219)
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:647)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:323)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:321)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
    at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:356)
    at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:214)
    at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1676)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:318)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:160)
    at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:734)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:673)
    at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:99)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:174)
    at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:415)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:282)
    at com.sun.enterprise.v3.services.impl.ContainerMapper$HttpHandlerCallable.call(ContainerMapper.java:459)
    at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:167)
    at org.glassfish.grizzly.http.server.HttpHandler.runService(HttpHandler.java:201)
    at org.glassfish.grizzly.http.server.HttpHandler.doHandle(HttpHandler.java:175)
    at org.glassfish.grizzly.http.server.HttpServerFilter.handleRead(HttpServerFilter.java:235)
    at org.glassfish.grizzly.filterchain.ExecutorResolver$9.execute(ExecutorResolver.java:119)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeFilter(DefaultFilterChain.java:284)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeChainPart(DefaultFilterChain.java:201)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.execute(DefaultFilterChain.java:133)
    at org.glassfish.grizzly.filterchain.DefaultFilterChain.process(DefaultFilterChain.java:112)
    at org.glassfish.grizzly.ProcessorExecutor.execute(ProcessorExecutor.java:77)
    at org.glassfish.grizzly.nio.transport.TCPNIOTransport.fireIOEvent(TCPNIOTransport.java:561)
    at org.glassfish.grizzly.strategies.AbstractIOStrategy.fireIOEvent(AbstractIOStrategy.java:112)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.run0(WorkerThreadIOStrategy.java:117)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.access$100(WorkerThreadIOStrategy.java:56)
    at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy$WorkerThreadRunnable.run(WorkerThreadIOStrategy.java:137)
    at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:565)
    at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:545)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.jboss.weld.exceptions.WeldException: WELD-000049: Unable to invoke public void com.szcommerce.ws.controller.OrientdbController.init() on com.szcommerce.ws.controller.OrientdbController@53e6b603
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.invokeMethods(DefaultLifecycleCallbackInvoker.java:100)
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.postConstruct(DefaultLifecycleCallbackInvoker.java:81)
    at org.jboss.weld.injection.producer.BasicInjectionTarget.postConstruct(BasicInjectionTarget.java:114)
    at org.jboss.weld.injection.producer.BeanInjectionTarget.postConstruct(BeanInjectionTarget.java:70)
    at org.jboss.weld.bean.ManagedBean.create(ManagedBean.java:153)
    at org.jboss.weld.context.AbstractContext.get(AbstractContext.java:96)
    at org.jboss.weld.manager.BeanManagerImpl.getReference(BeanManagerImpl.java:740)
    at org.jboss.weld.el.AbstractWeldELResolver.lookup(AbstractWeldELResolver.java:107)
    at org.jboss.weld.el.AbstractWeldELResolver.getValue(AbstractWeldELResolver.java:90)
    at javax.el.CompositeELResolver.getValue(CompositeELResolver.java:188)
    at com.sun.faces.el.DemuxCompositeELResolver._getValue(DemuxCompositeELResolver.java:176)
    at com.sun.faces.el.DemuxCompositeELResolver.getValue(DemuxCompositeELResolver.java:203)
    at com.sun.el.parser.AstIdentifier.getValue(AstIdentifier.java:116)
    at com.sun.el.parser.AstValue.getBase(AstValue.java:151)
    at com.sun.el.parser.AstValue.getValue(AstValue.java:200)
    at com.sun.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:226)
    at org.jboss.weld.el.WeldValueExpression.getValue(WeldValueExpression.java:50)
    at com.sun.faces.facelets.el.ELText$ELTextVariable.writeText(ELText.java:238)
    at com.sun.faces.facelets.compiler.TextInstruction.write(TextInstruction.java:85)
    ... 49 more
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.jboss.weld.injection.producer.DefaultLifecycleCallbackInvoker.invokeMethods(DefaultLifecycleCallbackInvoker.java:98)
    ... 67 more
Caused by: java.lang.ExceptionInInitializerError
    at com.orientechnologies.orient.core.serialization.serializer.record.string.ORecordSerializerStringAbstract.<clinit>(ORecordSerializerStringAbstract.java:47)
    at com.orientechnologies.orient.core.serialization.serializer.record.ORecordSerializerFactory.<init>(ORecordSerializerFactory.java:40)
    at com.orientechnologies.orient.core.serialization.serializer.record.ORecordSerializerFactory.<clinit>(ORecordSerializerFactory.java:32)
    at com.orientechnologies.orient.core.db.document.ODatabaseDocumentTx.<clinit>(ODatabaseDocumentTx.java:58)
    at com.szcommerce.ws.controller.OrientdbController.init(OrientdbController.java:28)
    ... 72 more
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "shutdownHooks")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:457)
    at java.security.AccessController.checkPermission(AccessController.java:884)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at java.lang.Runtime.addShutdownHook(Runtime.java:209)
    at com.orientechnologies.orient.core.OrientShutdownHook.<init>(OrientShutdownHook.java:20)
    at com.orientechnologies.orient.core.Orient.startup(Orient.java:125)
    at com.orientechnologies.orient.core.Orient.<init>(Orient.java:76)
    at com.orientechnologies.orient.core.Orient.<clinit>(Orient.java:53)
    ... 77 more

Andrey Lomakin

unread,
Jan 22, 2015, 2:20:29 AM1/22/15
to orient-database
Hi,
Could you open issue about this, it is not hard to fix.

--

---
You received this message because you are subscribed to the Google Groups "OrientDB" group.
To unsubscribe from this group and stop receiving emails from it, send an email to orient-databa...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.



--
Best regards,
Andrey Lomakin.

Reply all
Reply to author
Forward
0 new messages