Protect initialization of ResourceLinkFactory when running with a Sec…

…urityManager. git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc8.0.x/trunk@1725929 13f79535-47bb-0310-9956-ffa450edef68
apache · Jan 21, 2016 · 0531f7a · 0531f7a
1 parent 0067d0e
commit 0531f7a
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/java/org/apache/naming/factory/ResourceLinkFactory.java b/java/org/apache/naming/factory/ResourceLinkFactory.java
@@ -60,6 +60,11 @@ public class ResourceLinkFactory
      * @param newGlobalContext new global context value
      */
     public static void setGlobalContext(Context newGlobalContext) {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new RuntimePermission(
+                   ResourceLinkFactory.class.getName() + ".setGlobalContext"));
+        }
         globalContext = newGlobalContext;
     }
 

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
@@ -147,6 +147,10 @@
         <bug>58900</bug>: Correctly undeploy symlinked resources and prevent an
         infinite cycle of deploy / undeploy. (markt)
       </fix>
+      <fix>
+        Protect initialization of <code>ResourceLinkFactory</code> when
+        running with a SecurityManager. (kkolinko)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">