From efb5d036113898186bbc8a0eb0626c9c37fab588 Mon Sep 17 00:00:00 2001 From: Alex Petrov Date: Mon, 15 Feb 2021 15:23:54 +0100 Subject: [PATCH] Avoid using insecure class loader, while picking a right parent class loader for in-jvm dtests Patch by Alex Petrov; reviewed by Marcus Eriksson for CASSANDRA-16448. --- .../cassandra/cql3/functions/JavaBasedUDFunction.java | 2 +- .../org/apache/cassandra/cql3/functions/UDFunction.java | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/src/java/org/apache/cassandra/cql3/functions/JavaBasedUDFunction.java b/src/java/org/apache/cassandra/cql3/functions/JavaBasedUDFunction.java index 30f4c957c6..660d494456 100644 --- a/src/java/org/apache/cassandra/cql3/functions/JavaBasedUDFunction.java +++ b/src/java/org/apache/cassandra/cql3/functions/JavaBasedUDFunction.java @@ -615,7 +615,7 @@ final class JavaBasedUDFunction extends UDFunction { EcjTargetClassLoader() { - super(UDFClassLoader.insecureClassLoader); + super(UDFunction.udfClassLoader); } // This map is usually empty. diff --git a/src/java/org/apache/cassandra/cql3/functions/UDFunction.java b/src/java/org/apache/cassandra/cql3/functions/UDFunction.java index 224d775914..f15155409c 100644 --- a/src/java/org/apache/cassandra/cql3/functions/UDFunction.java +++ b/src/java/org/apache/cassandra/cql3/functions/UDFunction.java @@ -173,7 +173,7 @@ public abstract class UDFunction extends AbstractFunction implements ScalarFunct return false; } - // setup the UDF class loader with no parent class loader so that we have full control about what class/resource UDF uses + // setup the UDF class loader with a context class loader as a parent so that we have full control about what class/resource UDF uses static final ClassLoader udfClassLoader = new UDFClassLoader(); protected UDFunction(FunctionName name, @@ -556,11 +556,16 @@ public abstract class UDFunction extends AbstractFunction implements ScalarFunct MigrationManager.announceNewFunction(this, true); } - static class UDFClassLoader extends ClassLoader + private static class UDFClassLoader extends ClassLoader { // insecureClassLoader is the C* class loader static final ClassLoader insecureClassLoader = Thread.currentThread().getContextClassLoader(); + private UDFClassLoader() + { + super(insecureClassLoader); + } + public URL getResource(String name) { if (!secureResource(name))