Package ognl.security

Class OgnlSecurityManager

java.lang.Object
java.lang.SecurityManager
ognl.security.OgnlSecurityManager
@Deprecated public class OgnlSecurityManager extends SecurityManager
Deprecated.
will be removed in 3.5.x
Wraps current security manager with JDK security manager if is inside OgnlRuntime user's methods body execution.

Add the `-Dognl.security.manager` to JVM options to enable.

Note: Due to potential performance and concurrency issues, try this only if you afraid your app can have an unknown "expression injection" flaw or you afraid you cannot prevent those in your app's internal sandbox comprehensively e.g. you cannot discover and maintain all attack vectors over time because of many dependencies and also their change over time.

This tries to provide an option to you to enable a security manager that disables any sensitive action e.g. exec and exit even if attacker had a successful "expression injection" in any unknown way into your app. However, also honors previous security manager and policies if any set, as parent, and rolls back to them after method execution finished.

Since:
3.1.24

  • Field Details

    • OGNL_SANDBOX_CLASS_NAME

      private static final String OGNL_SANDBOX_CLASS_NAME
      Deprecated.
      See Also:

    • CLASS_LOADER_CLASS

      private static final Class<?> CLASS_LOADER_CLASS
      Deprecated.

    • FILE_PERMISSION_CLASS

      private static final Class<?> FILE_PERMISSION_CLASS
      Deprecated.

    • parentSecurityManager

      private final SecurityManager parentSecurityManager
      Deprecated.

    • residents

      private final List<Long> residents
      Deprecated.

    • rnd

      private final SecureRandom rnd
      Deprecated.

  • Constructor Details

    • OgnlSecurityManager

      public OgnlSecurityManager(SecurityManager parentSecurityManager)
      Deprecated.

  • Method Details