TUSCANY-3925 - Apply Jennifer's Java security patch.

git-svn-id: http://svn.us.apache.org/repos/asf/tuscany@1162160 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 33 insertions, 6 deletions

diff --git a/sca-java-2.x/trunk/modules/extensibility/src/main/java/org/apache/tuscany/sca/core/DefaultFactoryExtensionPoint.java b/sca-java-2.x/trunk/modules/extensibility/src/main/java/org/apache/tuscany/sca/core/DefaultFactoryExtensionPoint.java
index 1c49ea4ee4..ae7d83009e 100644
--- a/sca-java-2.x/trunk/modules/extensibility/src/main/java/org/apache/tuscany/sca/core/DefaultFactoryExtensionPoint.java
+++ b/sca-java-2.x/trunk/modules/extensibility/src/main/java/org/apache/tuscany/sca/core/DefaultFactoryExtensionPoint.java
@@ -25,6 +25,8 @@ import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
@@ -103,7 +105,7 @@ public class DefaultFactoryExtensionPoint implements FactoryExtensionPoint {
      * @param factoryInterface The lookup key (factory interface)
      * @return The factory
      */    
-    public <T> T getFactory(Class<T> factoryInterface) {
+    public <T> T getFactory(final Class<T> factoryInterface) {
         Object factory = factories.get(factoryInterface);
         if (factory == null) {
 
@@ -128,12 +130,37 @@ public class DefaultFactoryExtensionPoint implements FactoryExtensionPoint {
                     
                     // If the input interface is an abstract class
                     if (!factoryInterface.isInterface() && Modifier.isAbstract(factoryInterface.getModifiers())) {
-                        Method newInstanceMethod = factoryInterface.getDeclaredMethod("newInstance");
-                        ClassLoader tccl = setContextClassLoader(factoryInterface.getClassLoader());
+                    
+                        Method newInstanceMethod;
                         try {
-                            
-                            // Create a new instance
-                            factory = newInstanceMethod.invoke(null);
+                            newInstanceMethod = AccessController.doPrivileged(new PrivilegedExceptionAction<Method>() {
+                                public Method run() throws Exception {
+                                    return factoryInterface.getDeclaredMethod("newInstance");
+                                }
+                            });
+                        } catch (PrivilegedActionException e){
+                            throw (Exception)e.getException();
+                        }
+                        
+                        ClassLoader cl = AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
+                            public ClassLoader run() {
+                                ClassLoader cl = factoryInterface.getClassLoader();
+                                return cl;
+                            }
+                        });
+                        ClassLoader tccl = setContextClassLoader(cl);
+                        try {
+                            try {
+                                final Method fnewInstanceMethod = newInstanceMethod;
+                                factory = AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() {
+                                public Object run() throws Exception {
+                                    Object factory = fnewInstanceMethod.invoke(null);
+                                    return factory;
+                                }
+                            });
+                            } catch (PrivilegedActionException e){
+                                throw (Exception)e.getException();
+                            }
                             
                             // Cache the factory
                             factories.put(factoryInterface, factory);