archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 14:54:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8338536: Permanently disable remote code downloading in JNDI

Browse source 
Reviewed-by: dfuchs
This commit is contained in:
Aleksei Efimov 2024-11-21 20:55:02 +00:00
parent 7709d435d0
commit cee74f9e67
11 changed files with 364 additions and 252 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/java.naming/share/classes/javax/naming/spi/NamingManager.java
View file

@ -123,9 +123,12 @@ public class NamingManager {
* or {@code Referenceable} containing a factory class name,
* use the named factory to create the object.
* Return {@code refInfo} if the factory cannot be created.
* Under JDK 1.1, if the factory class must be loaded from a location
* specified in the reference, a {@code SecurityManager} must have
* been installed or the factory creation will fail.
* Downloading a factory class from a location specified in the reference
* can be supported by a custom implementation of {@link ObjectFactoryBuilder}.
* The {@linkplain Reference#getFactoryClassLocation() factory class
* location}, if present, is ignored. A custom {@link ObjectFactoryBuilder}
* {@linkplain #setObjectFactoryBuilder(ObjectFactoryBuilder) may be used}
* if a different policy is desired.
* If an exception is encountered while creating the factory,
* it is passed up to the caller.
* <li>If {@code refInfo} is a {@code Reference} or