18.4.6. Java Security
Java classes are hosted in one of two modes:
- Restricted
- Unrestricted
Java class Permissions are managed by security classes that fall into categories as follows listed with it managing class:
- File - java.io.FilePermission
- Socket - java.net.SocketPermission
- Net - java.net.NetPermission
- Security - java.security.SecurityPermission
- Runtime - java.lang.RuntimePermission
- Property - java.util.PropertyPermission
- AWT - java.awt.AWTPermission
- Reflect - java.lang.reflect.ReflectPermission
- Serializable - java.io.SerializablePermission
Restricted classes are not allowed any of the above privileges. Virtuoso returns errors that are returned by the security manager if breaches in security are attempted by a hosted Java class.
By default all Java classes are imported/created/hosted in restricted
mode. To create Java class based user defined types that are
unrestricted you need to use create type syntax with UNRESTRICTED
keyword. The
import_jar()
function can also be used to import classes, its third optional
parameter can be used to define the security mode.
|
Note: |
|---|---|
|
New behavior since Virtuoso 3.2 provides these two security modes defaulting to restricted. Prior to this Java classes were hosted in unrestricted mode. |
Example 18.1. Java Security
The class Write_file, shown below, will attempt to write to a file on the file system. This class will be used to create a user defined type first in unrestricted mode and then in restricted mode to demonstrate how security exceptions are returned.
Source of Write_file.java:
import java.io.*;
public class Write_file
{
public String write ()
{
String myFile = "foo";
File f = new File(myFile);
DataOutputStream dos;
try
{
dos = new DataOutputStream (new BufferedOutputStream(new FileOutputStream (myFile),128));
dos.writeBytes("ABC\n");
dos.flush();
dos.close();
}
catch (IOException ioe)
{
System.out.println("writeFile: caught i/o exception");
}
return "OK";
}
}
Create the unrestricted type:
create type "Write_file" language JAVA external name 'Write_file'
unrestricted METHOD "write" ()
returns nvarchar external type 'Ljava/lang/String;' external name 'write';
Test calling the method:
SQL> select new Write_file().write();
callret
NVARCHAR
_________________________________________
OK
Now we want to recreate the type in restricted mode, remembering to drop it first:
drop type DB.DBA.write_file;
create type "Write_file" language JAVA external name 'Write_file'
METHOD "write" ()
returns nvarchar external type 'Ljava/lang/String;' external name 'write';
Test calling the method:
SQL> select new Write_file().write();
*** Error 42000: [Virtuoso Driver][Virtuoso Server]JV001: Java exception
occurred : java.security.AccessControlException : access denied
(java.io.FilePermission foo write)
in __udt_method_call:(BIF),
<Top Level>
at line 1 of Top-Level:
select new Write_file().write()
Another way to import the above class is by use the
import_jar() such as:
import_jar (NULL, 'Write_file', 1) - will import java classes in unrestricted mode.
import_jar (NULL, 'Write_file') - will import java classes in restricted mode.