107313 - LiveConnect doesn't supply nice way to control class loader

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Java: Live Connect, defect)

Description

[Timothy J. Wood]

Mozilla seems to use a proxy JNIEnv and a stack of JSContext information 
to turn the FindClass JNI hook into a call to the right class loader 
instance.

This is more complicated than it seems it should be (especially if you 
aren't Mozilla).

Instead, I propose the following new LiveConnect hook:

    /* Returns the Java class for the given name.  This is the primary 
security hook
       for LiveConnect.  Based on the global object of the JSContext, a 
different
       Java ClassLoader instance can be used to isolate Java code from 
different
       sources into their own sandboxen.
    
       If this hook is NULL, the default class loader is used (which is not 
secure by default).
    */
    jclass		(*find_class)(JNIEnv *env, JSContext *cx, const char *
className);

Comment 1

[Phil Schwartau]

Formally confirming bug. Reassigning to Patrick; cc'ing Brendan, rogerl
and mstoltz for consideration of this issue.

Comment 2

[Patrick C. Beard]

As discussed in e-mail, this isn't sufficient for securing LiveConnect itself, 
but seems like a reasonable addition. In the current OJI implementation, 
a class loader can be associated with the JSContext by rooting a JNI 
reference to the class loader in the global object.

Comment 3

[Timothy J. Wood]

Attachment: Proposed patch

Comment 4

[Timothy J. Wood]

The patch above contains my proposed patch for this bug and #107311 (since they effect the same callback struct)

Comment 5

[Bob Clary [:bc] (inactive)]

-> default assignee for old netscape assigned bugs.

Comment 6

[Benjamin Smedberg]

Firefox code moved from custom Liveconnect code to the NPAPI/NPRuntime bridge a while back. Mass-closing the bugs in the liveconnect component which are likely invalid. If you believe that this bug is still relevant to modern versions of Firefox, please reopen it and move it the "Core" product, component "Plug-Ins".