{"action":"closed","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5411","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5411/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5411/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5411/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5411","id":140721402,"number":5411,"title":"org.springframework.boot.loader.jar.JarURLConnection does not allow usage of SecurityManager without java.security.AllPermission","user":{"login":"Fiouz","id":393371,"avatar_url":"https://avatars.githubusercontent.com/u/393371?v=3","gravatar_id":"","url":"https://api.github.com/users/Fiouz","html_url":"https://github.com/Fiouz","followers_url":"https://api.github.com/users/Fiouz/followers","following_url":"https://api.github.com/users/Fiouz/following{/other_user}","gists_url":"https://api.github.com/users/Fiouz/gists{/gist_id}","starred_url":"https://api.github.com/users/Fiouz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fiouz/subscriptions","organizations_url":"https://api.github.com/users/Fiouz/orgs","repos_url":"https://api.github.com/users/Fiouz/repos","events_url":"https://api.github.com/users/Fiouz/events{/privacy}","received_events_url":"https://api.github.com/users/Fiouz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false},"assignees":[{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/64","html_url":"https://github.com/spring-projects/spring-boot/milestones/1.3.6","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/64/labels","id":1755816,"number":64,"title":"1.3.6","description":"","creator":{"login":"snicoll","id":490484,"avatar_url":"https://avatars.githubusercontent.com/u/490484?v=3","gravatar_id":"","url":"https://api.github.com/users/snicoll","html_url":"https://github.com/snicoll","followers_url":"https://api.github.com/users/snicoll/followers","following_url":"https://api.github.com/users/snicoll/following{/other_user}","gists_url":"https://api.github.com/users/snicoll/gists{/gist_id}","starred_url":"https://api.github.com/users/snicoll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snicoll/subscriptions","organizations_url":"https://api.github.com/users/snicoll/orgs","repos_url":"https://api.github.com/users/snicoll/repos","events_url":"https://api.github.com/users/snicoll/events{/privacy}","received_events_url":"https://api.github.com/users/snicoll/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":42,"state":"open","created_at":"2016-05-09T16:05:14Z","updated_at":"2016-06-24T10:53:51Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2016-03-14T16:17:03Z","updated_at":"2016-06-24T10:53:51Z","closed_at":"2016-06-24T10:53:51Z","body":"When activating the JVM default security manager with some reasonable policy file (`-Djava.security.manager -Djava.security.policy=XXX`), a self-contained JAR file created by `org.springframework.boot:spring-boot-maven-plugin:1.3.3.RELEASE:repackage` cannot load classes:\r\n\r\n```\r\nException in thread \"main\" java.lang.RuntimeException: java.lang.reflect.InvocationTargetException\r\n\tat org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:62)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\nCaused by: java.lang.reflect.InvocationTargetException\r\n\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\r\n\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\r\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\r\n\tat java.lang.reflect.Method.invoke(Method.java:498)\r\n\tat org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:54)\r\n\t... 1 more\r\nCaused by: java.lang.NoClassDefFoundError: org/springframework/boot/SpringApplication\r\n\tat com.example.DemoApplication.main(DemoApplication.java:10)\r\n\t... 6 more\r\nCaused by: java.lang.ClassNotFoundException: org.springframework.boot.SpringApplication\r\n\tat java.net.URLClassLoader.findClass(URLClassLoader.java:381)\r\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:424)\r\n\tat sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)\r\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:357)\r\n\t... 7 more\r\n```\r\n\r\n\r\nActivating Java security debugging features `-Djava.security.debug=access,failure` reveals that Spring Boot requires the `java.security.AllPermission` permission, which defeats the purpose of setting up a security manager:\r\n```\r\naccess: access denied (\"java.security.AllPermission\" \"<all permissions>\" \"<all actions>\")\r\njava.lang.Exception: Stack trace\r\n\tat java.lang.Thread.dumpStack(Thread.java:1329)\r\n\tat java.security.AccessControlContext.checkPermission(AccessControlContext.java:462)\r\n\tat java.security.AccessController.checkPermission(AccessController.java:884)\r\n\tat java.lang.SecurityManager.checkPermission(SecurityManager.java:549)\r\n\tat java.net.URLClassLoader$4.run(URLClassLoader.java:709)\r\n\tat java.net.URLClassLoader$4.run(URLClassLoader.java:707)\r\n\tat java.security.AccessController.doPrivileged(Native Method)\r\n\tat java.net.URLClassLoader.getPermissions(URLClassLoader.java:707)\r\n\tat java.security.SecureClassLoader.getProtectionDomain(SecureClassLoader.java:206)\r\n\tat java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)\r\n\tat java.net.URLClassLoader.defineClass(URLClassLoader.java:467)\r\n\tat java.net.URLClassLoader.access$100(URLClassLoader.java:73)\r\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:368)\r\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:362)\r\n\tat java.security.AccessController.doPrivileged(Native Method)\r\n\tat java.net.URLClassLoader.findClass(URLClassLoader.java:361)\r\n\tat org.springframework.boot.loader.LaunchedURLClassLoader.doLoadClass(LaunchedURLClassLoader.java:170)\r\n\tat org.springframework.boot.loader.LaunchedURLClassLoader.loadClass(LaunchedURLClassLoader.java:142)\r\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:357)\r\n\tat org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:48)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\n```\r\n\r\nPolicy file used `-Djava.security.policy=XXX` (obviously, declaring AllPermission should not be an acceptable option):\r\n```\r\ngrant {\r\n  permission java.lang.RuntimePermission \"*\";\r\n  permission java.io.FilePermission \"*\", \"read,write,delete\";\r\n  permission java.net.NetPermission \"*\";\r\n  permission java.util.PropertyPermission \"*\", \"read,write\";\r\n};\r\n```\r\n\r\nThe root cause seems to be `org.springframework.boot.loader.jar.JarURLConnection` that does not override `java.net.URLConnection.getPermission`(https://docs.oracle.com/javase/7/docs/api/java/net/URLConnection.html#getPermission%28%29):\r\n\r\n> By default, this method returns java.security.AllPermission. Subclasses should override this method and return the permission that best represents the permission required to make a a connection to the URL"}}
{"actor":{"display_login":"wilkinsona"}}