AC Debugger throwing an error instead of logging the exception #50
Comments
|
The first 6 domains in the access control context comes from the inherited access control context (ACC) on line AccessControlContext.java:572. The rest are from the stack. The current ACD implementation assumed that combined domains could only appear after all stack domains but that is not the case. An ACC may have a privileged ACC, if not than the inherited one is retrieved. If no combiner is associated with the privileged ACC (or inherited ACC), then its domains if any are placed first, followed by stack domains which can be optimized (entries removed if they were already added before). The implementation should be modified such that we get the pure set of stack domains and if we can find that exact list as is (assuming that entries can be skipped if they were already defined before), then that would be our start of stack domain index. Anything before is assumed to be combined and anything after is also assumed to be combined (as we are doing today). We should keep track of each entry in the computed list if it corresponds to a stack entry as only those can have privileges extended. Further more, there is a miss-conception that when we are computing solutions and analyzing them, we loose all combined domains when in fact there is no guaranty. We should think about recomputing an actual ACC and recompute the whole thing from there by cleaning the retrieved stack list of domains. This definitely requires a bit more work. |
Description
Running the AC Debugger with the following flags: -c -r -w
Steps to Reproduce
https://codice.atlassian.net/browse/DDF-4416
Expected behavior:
An access control exception to be logged
Actual behavior:
AC Debugger throws a warning
Reproduces how often:
100% of the time
Version
1.8-SNAPSHOT
Additional Information
Any additional information, configuration or data that might be necessary
to reproduce the issue.
The text was updated successfully, but these errors were encountered: