Top Description Fields Constructors Methods
org.apache.catalina.security

public final Class SecurityUtil

extends Object
Class Inheritance
Imports
java.io.IOException, java.lang.reflect.InvocationTargetException, .Method, java.security.Principal, .PrivilegedActionException, .PrivilegedExceptionAction, java.util.Map, java.util.concurrent.ConcurrentHashMap, javax.security.auth.Subject, jakarta.servlet.Filter, .Servlet, .ServletException, .UnavailableException, jakarta.servlet.http.HttpServletRequest, .HttpSession, org.apache.catalina.Globals, org.apache.juli.logging.Log, .LogFactory, org.apache.tomcat.util.ExceptionUtils, org.apache.tomcat.util.res.StringManager
This utility class associates a Subject to the current AccessControlContext. When a SecurityManager is used, the container will always associate the called thread with an AccessControlContext containing only the principal of the requested Servlet/Filter. This class uses reflection to invoke the methods.

Field Summary

Modifier and TypeField and Description
private static final Map<Class<?>, Method[]>
classCache

Cache every class for which we are creating methods.

private static final int
DESTROY

private static final String
DESTROY_METHOD

private static final int
DOFILTER

private static final String
DOFILTER_METHOD

private static final int
DOFILTEREVENT

private static final String
DOFILTEREVENT_METHOD

private static final int
EVENT

private static final String
EVENT_METHOD

private static final int
INIT

private static final String
INIT_METHOD

private static final Log
log

private static final boolean
packageDefinitionEnabled

private static final int
SERVICE

private static final String
SERVICE_METHOD

private static final StringManager
sm

The string resources for this package.

Constructor Summary

AccessConstructor and Description
public
SecurityUtil()

Method Summary

Modifier and TypeMethod and Description
private static Method

Returns:

the method instance.
createMethodAndCacheIt(Method[]
the cache used to store method instance
methodsCache, Class<?>
the class on which the method will be called.
targetType, String
the method to apply the security restriction
methodName, Class<?>[]
Class array used to instantiate a Method object.
parameterTypes)

Create the method and cache it for further re-use.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Servlet
the Servlet on which the method will be called.
targetObject)

Perform work as a particular Subject.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Servlet
the Servlet on which the method will be called.
targetObject, final Class<?>[]
Class array used to instantiate a Method object.
targetType, final Object[]
Object array contains the runtime parameters instance.
targetArguments)

Perform work as a particular Subject.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Servlet
the Servlet on which the method will be called.
targetObject, final Class<?>[]
Class array used to instantiate a Method object.
targetParameterTypes, final Object[]
Object array contains the runtime parameters instance.
targetArguments, Principal
the Principal to which the security privilege applies
principal)

Perform work as a particular Subject.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Filter
the Filter on which the method will be called.
targetObject)

Perform work as a particular Subject.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Filter
the Filter on which the method will be called.
targetObject, final Class<?>[]
Class array used to instantiate a Method object.
targetType, final Object[]
Object array contains the runtime parameters instance.
targetArguments)

Perform work as a particular Subject.

public static void
doAsPrivilege(final String
the method to apply the security restriction
methodName, final Filter
the Filter on which the method will be called.
targetObject, final Class<?>[]
Class array used to instantiate a Method object.
targetParameterTypes, final Object[]
Object array contains the runtime parameters instance.
targetParameterValues, Principal
the Principal to which the security privilege applies
principal)

Perform work as a particular Subject.

private static void
execute(final Method
the method to apply the security restriction
method, final Object
the Servlet on which the method will be called.
targetObject, final Object[]
Object array contains the runtime parameters instance.
targetArguments, Principal
the Principal to which the security privilege applies
principal)

Perform work as a particular Subject.

private static Method

Returns:

the method instance, null if not yet created.
findMethod(Method[]
the cache used to store method instance
methodsCache, String
the method to apply the security restriction
methodName)

Find a method stored within the cache.

public static boolean

Returns:

true if package level protection is enabled
isPackageProtectionEnabled()

Return the SecurityManager only if Security is enabled AND package protection mechanism is enabled.

public static void
remove(Object
The object to remove
cachedObject)

Remove the object from the cache.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

classCacheback to summary
private static final Map<Class<?>, Method[]> classCache

Cache every class for which we are creating methods.

DESTROYback to summary
private static final int DESTROY
DESTROY_METHODback to summary
private static final String DESTROY_METHOD
DOFILTERback to summary
private static final int DOFILTER
DOFILTER_METHODback to summary
private static final String DOFILTER_METHOD
DOFILTEREVENTback to summary
private static final int DOFILTEREVENT
DOFILTEREVENT_METHODback to summary
private static final String DOFILTEREVENT_METHOD
EVENTback to summary
private static final int EVENT
EVENT_METHODback to summary
private static final String EVENT_METHOD
INITback to summary
private static final int INIT
INIT_METHODback to summary
private static final String INIT_METHOD
logback to summary
private static final Log log
packageDefinitionEnabledback to summary
private static final boolean packageDefinitionEnabled
SERVICEback to summary
private static final int SERVICE
SERVICE_METHODback to summary
private static final String SERVICE_METHOD
smback to summary
private static final StringManager sm

The string resources for this package.

Constructor Detail

SecurityUtilback to summary
public SecurityUtil()

Method Detail

createMethodAndCacheItback to summary
private static Method createMethodAndCacheIt(Method[] methodsCache, Class<?> targetType, String methodName, Class<?>[] parameterTypes) throws Exception

Create the method and cache it for further re-use.

Parameters
methodsCache:Method[]

the cache used to store method instance

targetType:Class<?>

the class on which the method will be called.

methodName:String

the method to apply the security restriction

parameterTypes:Class<?>[]

Class array used to instantiate a Method object.

Returns:Method

the method instance.

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Servlet targetObject) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Servlet

the Servlet on which the method will be called.

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Servlet targetObject, final Class<?>[] targetType, final Object[] targetArguments) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Servlet

the Servlet on which the method will be called.

targetType:Class<?>[]

Class array used to instantiate a Method object.

targetArguments:Object[]

Object array contains the runtime parameters instance.

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Servlet targetObject, final Class<?>[] targetParameterTypes, final Object[] targetArguments, Principal principal) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Servlet

the Servlet on which the method will be called.

targetParameterTypes:Class<?>[]

Class array used to instantiate a Method object.

targetArguments:Object[]

Object array contains the runtime parameters instance.

principal:Principal

the Principal to which the security privilege applies

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Filter targetObject) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Filter

the Filter on which the method will be called.

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Filter targetObject, final Class<?>[] targetType, final Object[] targetArguments) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Filter

the Filter on which the method will be called.

targetType:Class<?>[]

Class array used to instantiate a Method object.

targetArguments:Object[]

Object array contains the runtime parameters instance.

Exceptions
Exception:
an execution error occurred
doAsPrivilegeback to summary
public static void doAsPrivilege(final String methodName, final Filter targetObject, final Class<?>[] targetParameterTypes, final Object[] targetParameterValues, Principal principal) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
methodName:String

the method to apply the security restriction

targetObject:Filter

the Filter on which the method will be called.

targetParameterTypes:Class<?>[]

Class array used to instantiate a Method object.

targetParameterValues:Object[]

Object array contains the runtime parameters instance.

principal:Principal

the Principal to which the security privilege applies

Exceptions
Exception:
an execution error occurred
executeback to summary
private static void execute(final Method method, final Object targetObject, final Object[] targetArguments, Principal principal) throws Exception

Perform work as a particular Subject. Here the work will be granted to a null subject.

Parameters
method:Method

the method to apply the security restriction

targetObject:Object

the Servlet on which the method will be called.

targetArguments:Object[]

Object array contains the runtime parameters instance.

principal:Principal

the Principal to which the security privilege applies

Exceptions
Exception:
an execution error occurred
findMethodback to summary
private static Method findMethod(Method[] methodsCache, String methodName)

Find a method stored within the cache.

Parameters
methodsCache:Method[]

the cache used to store method instance

methodName:String

the method to apply the security restriction

Returns:Method

the method instance, null if not yet created.

isPackageProtectionEnabledback to summary
public static boolean isPackageProtectionEnabled()

Return the SecurityManager only if Security is enabled AND package protection mechanism is enabled.

Returns:boolean

true if package level protection is enabled

removeback to summary
public static void remove(Object cachedObject)

Remove the object from the cache.

Parameters
cachedObject:Object

The object to remove