1 /*
2  * JBoss, Home of Professional Open Source.
3  * Copyright 2014 Red Hat, Inc., and individual contributors
4  * as indicated by the @author tags.
5  *
6  * Licensed under the Apache License, Version 2.0 (the "License");
7  * you may not use this file except in compliance with the License.
8  * You may obtain a copy of the License at
9  *
10  *     http://www.apache.org/licenses/LICENSE-2.0
11  *
12  *  Unless required by applicable law or agreed to in writing, software
13  *  distributed under the License is distributed on an "AS IS" BASIS,
14  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15  *  See the License for the specific language governing permissions and
16  *  limitations under the License.
17  */
18
19 package io.undertow.servlet.core;
20
21
22 import java.security.AccessController;
23 import java.security.PrivilegedAction;
24
25 import javax.servlet.ServletContext;
26
27 import io.undertow.server.HttpHandler;
28 import io.undertow.server.session.Session;
29 import io.undertow.servlet.api.Deployment;
30 import io.undertow.servlet.handlers.ServletInitialHandler;
31 import io.undertow.servlet.handlers.ServletPathMatches;
32 import io.undertow.servlet.handlers.ServletRequestContext;
33 import io.undertow.servlet.spec.HttpSessionImpl;
34 import io.undertow.servlet.spec.ServletContextImpl;
35
36 final class SecurityActions {
37
38     private SecurityActions() {
39         // forbidden inheritance
40     }
41
42     /**
43      * Gets context classloader.
44      *
45      * @return the current context classloader
46      */
47     static ClassLoader getContextClassLoader() {
48         if (System.getSecurityManager() == null) {
49             return Thread.currentThread().getContextClassLoader();
50         } else {
51             return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
52                 public ClassLoader run() {
53                     return Thread.currentThread().getContextClassLoader();
54                 }
55             });
56         }
57     }
58
59     /**
60      * Sets context classloader.
61      *
62      * @param classLoader
63      *            the classloader
64      */
65     static void setContextClassLoader(final ClassLoader classLoader) {
66         if (System.getSecurityManager() == null) {
67             Thread.currentThread().setContextClassLoader(classLoader);
68         } else {
69             AccessController.doPrivileged(new PrivilegedAction<Object>() {
70                 public Object run() {
71                     Thread.currentThread().setContextClassLoader(classLoader);
72                     return null;
73                 }
74             });
75         }
76     }
77
78     static String getSystemProperty(final String prop) {
79         if (System.getSecurityManager() == null) {
80            return System.getProperty(prop);
81         } else {
82             return (String) AccessController.doPrivileged(new PrivilegedAction<Object>() {
83                 public Object run() {
84                     return System.getProperty(prop);
85                 }
86             });
87         }
88     }
89
90     static HttpSessionImpl forSession(final Session session, final ServletContext servletContext, final boolean newSession) {
91         if (System.getSecurityManager() == null) {
92             return HttpSessionImpl.forSession(session, servletContext, newSession);
93         } else {
94             return AccessController.doPrivileged(new PrivilegedAction<HttpSessionImpl>() {
95                 @Override
96                 public HttpSessionImpl run() {
97                     return HttpSessionImpl.forSession(session, servletContext, newSession);
98                 }
99             });
100         }
101     }
102
103     static ServletRequestContext currentServletRequestContext() {
104         if (System.getSecurityManager() == null) {
105             return ServletRequestContext.current();
106         } else {
107             return AccessController.doPrivileged(new PrivilegedAction<ServletRequestContext>() {
108                 @Override
109                 public ServletRequestContext run() {
110                     return ServletRequestContext.current();
111                 }
112             });
113         }
114     }
115
116     static void setCurrentRequestContext(final ServletRequestContext servletRequestContext) {
117         if (System.getSecurityManager() == null) {
118             ServletRequestContext.setCurrentRequestContext(servletRequestContext);
119         } else {
120             AccessController.doPrivileged(new PrivilegedAction<Object>() {
121                 @Override
122                 public Object run() {
123                     ServletRequestContext.setCurrentRequestContext(servletRequestContext);
124                     return null;
125                 }
126             });
127         }
128     }
129
130     static void clearCurrentServletAttachments() {
131         if (System.getSecurityManager() == null) {
132             ServletRequestContext.clearCurrentServletAttachments();
133         } else {
134             AccessController.doPrivileged(new PrivilegedAction<Object>() {
135                 @Override
136                 public Object run() {
137                     ServletRequestContext.clearCurrentServletAttachments();
138                     return null;
139                 }
140             });
141         }
142     }
143     static ServletRequestContext requireCurrentServletRequestContext() {
144         if (System.getSecurityManager() == null) {
145             return ServletRequestContext.requireCurrent();
146         } else {
147             return AccessController.doPrivileged(new PrivilegedAction<ServletRequestContext>() {
148                 @Override
149                 public ServletRequestContext run() {
150                     return ServletRequestContext.requireCurrent();
151                 }
152             });
153         }
154     }
155     static ServletInitialHandler createServletInitialHandler(final ServletPathMatches paths, final HttpHandler next, final Deployment deployment, final ServletContextImpl servletContext) {
156         if (System.getSecurityManager() == null) {
157             return new ServletInitialHandler(paths, next, deployment, servletContext);
158         } else {
159             return AccessController.doPrivileged(new PrivilegedAction<ServletInitialHandler>() {
160                 @Override
161                 public ServletInitialHandler run() {
162                     return new ServletInitialHandler(paths, next, deployment, servletContext);
163                 }
164             });
165         }
166     }
167 }
168