Re: macros

From:

ram@zedat.fu-berlin.de (Stefan Ram)

Newsgroups:

comp.lang.lisp,comp.lang.java.programmer

Date:

16 May 2009 16:06:58 GMT

Message-ID:

<Java-security-20090516180608@ram.dialup.fu-berlin.de>

pjb@informatimago.com (Pascal J. Bourguignon) writes:

In production environments, this might have security implications.
For example, it allows to inject one's code into clients of those
libraries.

In production environments, with any language, you can modify the
source recompile and have security implications.

  Java allows ?Applets? to be executed within a Web Browser.
  These programs have limited rights.

  Java has a framework to execute Java-WebStart-Applications
  or other applications with controlled rights.

  The library with the standard classes is called ?rt.jar?.

  Substitution a custom copy of ?rt.jar? has been made hard
  by the use of a a digital signature, IIRC.

  Therefore, I believe, one /cannot/ modify the sources of the
  standard classes, build one's own ?rt.jar? and submit this
  to a Java installation.

  All those security efforts could be circumvented, if an
  application could modify standard classes of its environment.

  I am not an expert regarding Java security, but this was as
  best as I remember it. Maybe people can correct me if I erred
  here.