Skip to content

keep the shared weaving cache out of the world-writable temp directory#360

Open
nabhan06 wants to merge 1 commit into
eclipse-aspectj:masterfrom
nabhan06:weaving-cache-private-dir
Open

keep the shared weaving cache out of the world-writable temp directory#360
nabhan06 wants to merge 1 commit into
eclipse-aspectj:masterfrom
nabhan06:weaving-cache-private-dir

Conversation

@nabhan06

Copy link
Copy Markdown

Shared weaving cache defaults to /tmp

With -Daj.weaving.cache.enabled=true -Daj.weaving.cache.impl=shared and no explicit aj.weaving.cache.dir, SimpleCacheFactory.PATH_DEFAULT puts the cache in the system temp directory, which every local user can write to. StoreableCachingMap.init deserializes cache.idx from there, readFromPath reads the paths it holds, and those bytes come back out of Aj.preProcess as the class definition (plus initializeClass calls defineClass on the generated-class entries), so a second local account picks what any woven class runs.

Default is now a per-user directory below java.io.tmpdir created with owner-only permissions, and a cache directory that is a symlink or is reachable by group or other is refused rather than used. Anyone who already sets aj.weaving.cache.dir to a private directory is unaffected; a directory that fails the check logs to stderr and turns the cache off instead of weaving from it.

Signed-off-by: sayed nabhan <nabhan@bugqore.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant