Class SecurityController
- java.lang.Object
- 
- org.mozilla.javascript.SecurityController
 
- 
- Direct Known Subclasses:
- PolicySecurityController,- SecurityProxy
 
 public abstract class SecurityController extends java.lang.ObjectThis class describes the support needed to implement security.Three main pieces of functionality are required to implement security for JavaScript. First, it must be possible to define classes with an associated security domain. (This security domain may be any object incorporating notion of access restrictions that has meaning to an embedding; for a client-side JavaScript embedding this would typically be java.security.ProtectionDomain or similar object depending on an origin URL and/or a digital certificate.) Next it must be possible to get a security domain object that allows a particular action only if all security domains associated with code on the current Java stack allows it. And finally, it must be possible to execute script code with associated security domain injected into Java stack. These three pieces of functionality are encapsulated in the SecurityController class. - Since:
- 1.5 Release 4
- See Also:
- Context.setSecurityController(SecurityController),- ClassLoader
 
- 
- 
Constructor SummaryConstructors Constructor Description SecurityController()
 - 
Method SummaryAll Methods Static Methods Instance Methods Abstract Methods Concrete Methods Deprecated Methods Modifier and Type Method Description java.lang.ObjectcallWithDomain(java.lang.Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, java.lang.Object[] args)CallCallable.call(Context cx, Scriptable scope, Scriptable thisObj, Object[] args)of callable under restricted security domain where an action is allowed only if it is allowed according to the Java stack on the moment of the execWithDomain call and securityDomain.abstract GeneratedClassLoadercreateClassLoader(java.lang.ClassLoader parentLoader, java.lang.Object securityDomain)Get class loader-like object that can be used to define classes with the given security context.static GeneratedClassLoadercreateLoader(java.lang.ClassLoader parent, java.lang.Object staticDomain)CreateGeneratedClassLoaderwith restrictions imposed by staticDomain and all current stack frames.java.lang.ObjectexecWithDomain(Context cx, Scriptable scope, Script script, java.lang.Object securityDomain)Deprecated.The application should not override this method and instead overridecallWithDomain(Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, Object[] args).abstract java.lang.ObjectgetDynamicSecurityDomain(java.lang.Object securityDomain)Get dynamic security domain that allows an action only if it is allowed by the current Java stack and securityDomain.static java.lang.Class<?>getStaticSecurityDomainClass()java.lang.Class<?>getStaticSecurityDomainClassInternal()static booleanhasGlobal()Check if globalSecurityControllerwas already installed.static voidinitGlobal(SecurityController controller)Initialize global controller that will be used for all security-related operations.
 
- 
- 
- 
Method Detail- 
hasGlobalpublic static boolean hasGlobal() Check if globalSecurityControllerwas already installed.
 - 
initGlobalpublic static void initGlobal(SecurityController controller) Initialize global controller that will be used for all security-related operations. The global controller takes precedence over already installedContext-specific controllers and cause any subsequent call toContext.setSecurityController(SecurityController)to throw an exception.The method can only be called once. - See Also:
- hasGlobal()
 
 - 
createClassLoaderpublic abstract GeneratedClassLoader createClassLoader(java.lang.ClassLoader parentLoader, java.lang.Object securityDomain) Get class loader-like object that can be used to define classes with the given security context.- Parameters:
- parentLoader- parent class loader to delegate search for classes not defined by the class loader itself
- securityDomain- some object specifying the security context of the code that is defined by the returned class loader.
 
 - 
createLoaderpublic static GeneratedClassLoader createLoader(java.lang.ClassLoader parent, java.lang.Object staticDomain) CreateGeneratedClassLoaderwith restrictions imposed by staticDomain and all current stack frames. The method uses the SecurityController instance associated with the currentContextto construct proper dynamic domain and create corresponding class loader.If no SecurityController is associated with the current Context, the method callsContext.createClassLoader(ClassLoader parent).- Parameters:
- parent- parent class loader. If null,- Context.getApplicationClassLoader()will be used.
- staticDomain- static security domain.
 
 - 
getStaticSecurityDomainClasspublic static java.lang.Class<?> getStaticSecurityDomainClass() 
 - 
getStaticSecurityDomainClassInternalpublic java.lang.Class<?> getStaticSecurityDomainClassInternal() 
 - 
getDynamicSecurityDomainpublic abstract java.lang.Object getDynamicSecurityDomain(java.lang.Object securityDomain) Get dynamic security domain that allows an action only if it is allowed by the current Java stack and securityDomain. If securityDomain is null, return domain representing permissions allowed by the current stack.
 - 
callWithDomainpublic java.lang.Object callWithDomain(java.lang.Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, java.lang.Object[] args)CallCallable.call(Context cx, Scriptable scope, Scriptable thisObj, Object[] args)of callable under restricted security domain where an action is allowed only if it is allowed according to the Java stack on the moment of the execWithDomain call and securityDomain. Any call togetDynamicSecurityDomain(Object)during execution ofcallable.call(cx, scope, thisObj, args)should return a domain incorporate restrictions imposed by securityDomain and Java stack on the moment of callWithDomain invocation.The method should always be overridden, it is not declared abstract for compatibility reasons. 
 - 
execWithDomain@Deprecated public java.lang.Object execWithDomain(Context cx, Scriptable scope, Script script, java.lang.Object securityDomain) Deprecated.The application should not override this method and instead overridecallWithDomain(Object securityDomain, Context cx, Callable callable, Scriptable scope, Scriptable thisObj, Object[] args).
 
- 
 
-