[kaffe] possible problem in Class.CallStack

gonzo Robert.N.Gonzalez at williams.edu
Wed Jul 24 08:03:24 PDT 2002

method getCallersClassLoader
line 463
  if (callingClass != null
      && callingClass.getName().equals("java.lang.reflect.Method")) {
		frame += 2;
		callingClass = callStack.getStackClass(frame);

it is possible for a programmer to write his own class loader which loads
a class java.lang.reflect.Method from his own java.lang.reflect package,
in which case getCallersClassLoader would return the Class of a method 2
frames deeper in the call stack than desired.

a possible fix is to check that, not only does
callingClass.getName().equals("java.lang.reflect.Method"), but also to
check that callingClass.getClassLoader() returns the system class loader.
this would only slow things down in the case where the second check is

i haven't poked around too much in the class loading/reflection libraries
enough to know if this is a security problem, but it's something to think
about (ie - i don't know why a person would do such a thing except to
attempt to break a system).


More information about the kaffe mailing list