From a9edd6af6e487b08c1105e3d2c962ecc29b62825 Mon Sep 17 00:00:00 2001 From: Brian Matzon Date: Sun, 2 Jul 2006 20:26:49 +0000 Subject: [PATCH] made Display priveledged action private. Fixes a possible security exploit that would allow anyone to get a boolean from System properties *gasp* --- src/java/org/lwjgl/opengl/Display.java | 2 +- src/java/org/lwjgl/opengl/MacOSXFrame.java | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/java/org/lwjgl/opengl/Display.java b/src/java/org/lwjgl/opengl/Display.java index f0f2b558..89d34e9e 100644 --- a/src/java/org/lwjgl/opengl/Display.java +++ b/src/java/org/lwjgl/opengl/Display.java @@ -711,7 +711,7 @@ public final class Display { /** * Gets a boolean property as a privileged action. */ - static boolean getPrivilegedBoolean(final String property_name) { + private static boolean getPrivilegedBoolean(final String property_name) { Boolean value = (Boolean)AccessController.doPrivileged(new PrivilegedAction() { public Object run() { return new Boolean(Boolean.getBoolean(property_name)); diff --git a/src/java/org/lwjgl/opengl/MacOSXFrame.java b/src/java/org/lwjgl/opengl/MacOSXFrame.java index 21ea781b..c92ba9f0 100644 --- a/src/java/org/lwjgl/opengl/MacOSXFrame.java +++ b/src/java/org/lwjgl/opengl/MacOSXFrame.java @@ -48,6 +48,7 @@ import java.awt.event.ComponentListener; import java.awt.event.WindowEvent; import java.awt.event.WindowListener; import java.security.AccessController; +import java.security.PrivilegedAction; import java.security.PrivilegedActionException; import java.security.PrivilegedExceptionAction; @@ -72,7 +73,7 @@ final class MacOSXFrame extends Frame implements WindowListener, ComponentListen addComponentListener(this); canvas = new MacOSXGLCanvas(); add(canvas, BorderLayout.CENTER); - boolean undecorated = Display.getPrivilegedBoolean("org.lwjgl.opengl.Window.undecorated"); + boolean undecorated = getPrivilegedBoolean("org.lwjgl.opengl.Window.undecorated"); setUndecorated(fullscreen || undecorated); if ( fullscreen ) { try { @@ -212,4 +213,16 @@ final class MacOSXFrame extends Frame implements WindowListener, ComponentListen } return result; } + + /** + * Gets a boolean property as a privileged action. + */ + private static boolean getPrivilegedBoolean(final String property_name) { + Boolean value = (Boolean)AccessController.doPrivileged(new PrivilegedAction() { + public Object run() { + return new Boolean(Boolean.getBoolean(property_name)); + } + }); + return value.booleanValue(); + } }