Security issues with dynamic loading

Hello

I am trying to run a simple RMI example that uses the dynamic class loading but I've hit a problem I can not move - can anyone help?

The problem I have, is that when I run my client program, I get the exception listed at the bottom of my post.

I have the following in my server called WarehouseServer class:
   System.setProperty("java.security.policy", "server.policy");  
   System.setSecurityManager(new SecurityManager());  
I have the a server.policy file located in the same folder as my server class:
    grant {    
        permission java.security.AllPermission "", "";    
    };   
I run my server using the following command:

* {noformat} java - Djava.rmi.server.codebase = http://localhost: 8080 / WarehouseServer {noformat} *.

I also tried to start the server by using this command:

* {noformat} java - Djava.rmi.server.codebase = http://localhost: 8080 /-Djava.security.policy = server.policy WarehouseServer {noformat} *.

But in both cases, I get the same exception when executing my client program.

Any idea?


See you soon,.

Sean.


=====================================================================


Exception in thread "main" java.rmi.UnmarshalException: error demarshalling return; nested exception is:
java.lang.ClassNotFoundException: book (no security manager: RMI class loader disabled)
at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:178)
at java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod(RemoteObjectInvocationHandler.java:178)
at java.rmi.server.RemoteObjectInvocationHandler.invoke(RemoteObjectInvocationHandler.java:132)
to $Proxy0.getProduct (Unknown Source)
at WarehouseClient.main (WarehouseClient.java:32)
Caused by: java.lang.ClassNotFoundException: book (no security manager: RMI class loader disabled)
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:375)
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:165)
in java.rmi.server.RMIClassLoader$ 2.loadClass(RMIClassLoader.java:620)
at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:247)
at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:197)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1574)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1495)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1731)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1328)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:350)
at sun.rmi.server.UnicastRef.unmarshalValue(UnicastRef.java:306)
at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:155)
... 4 more

You don't have a security manager in the server or in a windows .policy file either, unless the server will download code itself, which is not a normal scenario.

But you need to run your client with - Djava.security.manager or anything like that, or install a security manager in the client code. The customer shall also be a .policy windows file that allows all that must be allowed.

Tags: Java

Similar Questions

  • App Builder with dynamically loaded VI - please help

    Hello

    Please take a look in the ZIP file attached with the sample project. The appellant load sub dynamically. This works well in the development environment (LV 2011) but when I build the EXE, it stops working. Please take a look; Ideally, repost fixed project in this thread, others to take advantage of the way to solve this problem...

    Thank you!

    JorgeinSD

    Hi Jorge,.

    This is the problem of the ususal: in the executable path to your dynamically loaded VI Exchange.

    You have defined to be included in the executable. If the path passes to Appdir\DynLoad.exe\LoadMeDynamically.vi, but you try to open the path AppDir\LoadMeDynamically.vi...

    Options:

    -check the execution (by the property node) environment to decide which way to use

    -change the location of the VI to "support the directory", this will be a folder named 'data' next to your executable file. Call the VI of this folder. You can do the same thing inside your project to have the same calling conventions in the development and runtime environment...

  • Performance issues with dynamic action (PL/SQL)

    Hello!


    I have problems of perfomance with dynamic action that is triggered on click of a button.

    I have 5 drop-down lists to select the columns that users want filter, 5 drop-down lists to select an operation and 5 boxes of input values.

    After that, it has a filter button that submits just the page based on the selected filters.

    This part works fine, the data are filtered almost instantly.

    After that, I have 3 selectors 3 boxes where users put the values they wish to update the filtered rows and column

    There is a update button that calls the dynamic action (a procedure which is written below).

    It should be in a straight line, the issue of performance might be the decoding section, because I need to cover the case when the user wants to set a null (@), and when it won't update the 3 columns, but less (he leaves ").

    That's why P99_X_UC1 | ' = decode(' ||) P99_X_UV1 |', "«,» | P99_X_UC1 ||',''@'',null,'|| P99_X_UV1 |')

    However, when I click finally on the button update, my browser freezes and nothing happens on the table.

    Can anyone help me solve this problem and improve the speed of the update?

    Kind regards

    Ivan

    PS The procedure code is below:

    create or replace

    DWP PROCEDURE. PROC_UPD

    (P99_X_UC1 in VARCHAR2,

    P99_X_UV1 in VARCHAR2,

    P99_X_UC2 in VARCHAR2,

    P99_X_UV2 in VARCHAR2,

    P99_X_UC3 in VARCHAR2,

    P99_X_UV3 in VARCHAR2,

    P99_X_COL in VARCHAR2,

    P99_X_O in VARCHAR2,

    P99_X_V in VARCHAR2,

    P99_X_COL2 in VARCHAR2,

    P99_X_O2 in VARCHAR2,

    P99_X_V2 in VARCHAR2,

    P99_X_COL3 in VARCHAR2,

    P99_X_O3 in VARCHAR2,

    P99_X_V3 in VARCHAR2,

    P99_X_COL4 in VARCHAR2,

    P99_X_O4 in VARCHAR2,

    P99_X_V4 in VARCHAR2,

    P99_X_COL5 in VARCHAR2,

    P99_X_O5 in VARCHAR2,

    P99_X_V5 in VARCHAR2,

    P99_X_CD in VARCHAR2,

    P99_X_VD in VARCHAR2

    ) IS

    l_sql_stmt varchar2 (32600);

    nom_table_p varchar2 (30): = ' DWP. IZV_SLOG_DET';

    BEGIN

    l_sql_stmt: = "update". nom_table_p | 'set '.

    || P99_X_UC1 | ' = decode(' ||) P99_X_UV1 |', "«,» | P99_X_UC1 ||',''@'',null,'|| P99_X_UV1 |'),'

    || P99_X_UC2 | ' = decode(' ||) P99_X_UV2 |', "«,» | P99_X_UC2 ||',''@'',null,'|| P99_X_UV2 |'),'

    || P99_X_UC3 | ' = decode(' ||) P99_X_UV3 |', "«,» | P99_X_UC3 ||',''@'',null,'|| P99_X_UV3 |') where ' |

    P99_X_COL | » '|| P99_X_O | » ' || P99_X_V | «and» |

    P99_X_COL2 | » '|| P99_X_O2 | » ' || P99_X_V2 | «and» |

    P99_X_COL3 | » '|| P99_X_O3 | » ' || P99_X_V3 | «and» |

    P99_X_COL4 | » '|| P99_X_O4 | » ' || P99_X_V4 | «and» |

    P99_X_COL5 | » '|| P99_X_O5 | » ' || P99_X_V5 | «and» |

    P99_X_CD |       ' = '         || P99_X_VD;

    -dbms_output.put_line (l_sql_stmt);

    EXECUTE IMMEDIATE l_sql_stmt;

    END;

    Hello Ivan,.

    I don't think that the decoding is relevant performance. Perhaps the update is suspended because another transaction has changes that are uncommitted to any of the affected rows or where clause is not quite selective and has a huge amount of documents to update.

    In addition - and I may be wrong, because I only have a portion of your app - the code here looks like you've got a guy here huge sql injection vulnerability. Perhaps you should consider re - write your logic in the static sql. If this is not possible, you must make sure that the entered user contains only allowed values, for example by P99_X_On white list (i.e. to ensure that they contain only values known as 'is', ')<', ...),="" and="" by="" using="" dbms_assert.enquote_name/enquote_literal="" on="" the="" other="" p99_x_nnn="">

    Kind regards

    Christian

  • Security issues with workbook

    Hi all

    When I log in discoverer with responsibility 'a' I am able to see the output of the particular workbook.

    But when the same workbook ran by another user with differnet incongruous 'b' and with the same settings, it receives the message as ' ' the query caused no data to return.

    There seems to be some security issues. Can a good man trying to explain the process why the user is not able to display the output. To resolve this problem, what are the actions I have to do.

    Thank you for your support.

    Best regards
    Kumar.

    Hello

    The security package verifies that the current user can see the Organization passed as a parameter. She will probably do by getting the current responsibility of the user to the resp_id located in the FND_GLOBAL package. It checks then probably an inventory organization profile to determine the organizations to which that responsibility has access.

    However, it looks like a custom so security package you should examine the code inside the packaging to know what security profiles are used.

    Rod West

  • Cannot reset Apple ID same security issues with the link for valid reset. Help?

    So, I'm trying to reset my security questions, because I forgot the answers. I followed all the procedures to do, but it won't work.

    I clicked on the link for reset enter my Apple ID account page, then get the message: 'Reset Instructions sent. An email with the instructions was sent to @emailaddress. Follow the instructions in the email to reset your security questions. » - OK

    I opened the email: "Dear ME, recently made you a request to reset your Apple ID security questions and answers. To complete the process, click on the link below. Reset now >"I click on the link, it opens a new window with a login screen. - OK

    On the login screen, I entered my account information, email, and password in the fields and click the button to continue. Instead of connect, I get the message pop-under from the password field as follows: - FAIL

    I try again and again, but it never works. Whenever I get my password and trying to proceed, the loading spinner runs for a bit, then I get this message "to reset your security questions, sign in to your account and start again." I have never spent this page and in a region where I am able to actually reset my security questions. I tried with all browsers, Firefox, Chrome, Safari... nothing works. Now, I have tried 3 times reset by e-mail. It will not work. What is going on? Is the site broken?

    To make things worse, I don't have an option to call for framing according to the Apple website. The only option I get is to contact my operator. What the * is my carrier will repair my Apple ID? It's very frustrating say the least. Someone please help!

    You cannot reset the Security Questions If you forgot the. You can only reset them if you know them (which means that you also know your password).

    You can contact the Apple Support here to have a reset link you sent once they verify your identity:

    ACCOUNT SECURITY SUPPORT

    Good luck

    GB

  • Security issues with Microsoft Security essential and other anti-malware, anti-spyware programs

    Hello, I would like you to help mewith the following questions...

    Related to the question of the conflict between the programs microsoft security essential antivirus and antimalware bytes free (anti-malware) what is your opinion? Can they work together?
    And a second question: can I have windows firewall turned on at the same time with another protection in real time from the anti-malware bytes and Super anti-spyware free software?
    And the last question: what Windows Defender?
    I disabled it in my computer, probably because I use Mr. S. Essential, is necessary in the 32-bit edition of Vista business with MSE and Antimalware running together?
    Thnx in advance...

    Free Malwarebytes and Superantispyware Free cause no conflict with Microsoft Security Essentials.

    Keep Windows Firewall turned on.
    You can't and don't need to use Windows Defender on Vista, when you use Microsoft Security Essentials.

    You can find the answers to these questions and others like it in the FAQ Guide reference Microsoft Security Essentials
  • Security issues with Zip files

    Let me start by saying that I have already disabled UAC on my Vista machine because I have trouble trying to do simple things like rename or delete a directory that I created.  Now, I have a problem with Zip files.  It seems that when I try to open a zip file that is sent to me by email I receive now an error message stating:

    Windows found that this file is potentially harmful.

    To help protect your computer, Windows has blocked access to this file.

    Name: Images for contest mar09

    How does it help protect my computer?

    How indeed?  There is no option for me to go forward with this.  I'm trying like Vista, but these continuous dams to my productivity are killing me.  Can someone tell me how I can get it?  Any help would be appreciated.  Thank you!

    Rick

    Hi Rick,

    Your image has not come through.  What type of program you use for email? This happens with all files zip or just this one?

    Try to right click on the file and save it.  Scan it with your antivirus to make sure.  Right-click on the file that you saved, and then select Properties.  Look down and see if there is an entry of security telling you that the file is blocked.  If you are sure that it is virus-free, click the Unlock button.

    Let me know if this helps.
    Brent
    Microsoft Answers Support Engineer
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • Security issue with my computer

    I could not connect on my laptop, the said invalid user profile.  Then I found a unauthorized access to my Microsoft Account which took place the same day a security update has been through.  I see how to fix my user profile, but ask yourself what has happened and how to make sure I'm sure.  Also can I report this to Microsoft?  Yes, I changed all my passwords! I also received an email from spam with my old gmail password.  Yes, I've changed that too.

    Thank you, this has been an incredibly frustrating situation

    Original title:-security problems.

    Hi Juliet,.

    Thanks for posting your query on the Microsoft Community. I understand the frustration that you cross as your account had security threat. I will definitely help you with this.

    I suggest you to run Microsoft Safety Scanner on your system and check if it helps. The Microsoft Security Scanner is a downloadable security tool for free which allows analysis at the application and helps remove viruses, spyware and other malware. It works with your current antivirus software.

    How to boost your defense of malware and protect your PC:

    https://www.Microsoft.com/security/PC-security/protect-PC.aspx

    Note: the data files that are infected must be cleaned only by removing the file completely, which means there is a risk of data loss.

    Kindly click on the link for more information below:

    http://Windows.Microsoft.com/en-us/Windows-Live/ID-support

    Hope this information is useful. Please feel free to answer in the case where you are facing in the future other problems with Windows.

    Thank you.

  • Security issues with SMB concern files MS Office network locations

    On our windows 7 machines of our users we have problem of slowness of opening Office files from a network location

    This slowness only affect the users in the domain.  Domain Admins have no problem of slowness.

    Changes to approved documents ro trust location.  Location of trusted network has no effect.

    If I disable SMB users in the domain can open network location with no slow Office files.

    Any ideas?

    This issue is beyond the scope of this site and must be placed on Technet or MSDN

    http://social.technet.Microsoft.com/forums/en-us/home

    http://social.msdn.Microsoft.com/forums/en-us/home

  • What are the security issues with a virtual machine?

    The question is in fact a need to install firewalls, antivirus etc. on the virtual machine or the protections on the host protect the virtual machine when it is connected to the internet?

    In General a Virtual Machine that has network connectivity is no different, then a physical Machine with network connectivity and the other must act accordingly.  In other words, a Virtual Machine is subject to the same issues that a physical Machine is when it come to be infected if connected to other physical or virtual systems and or Internet and appropriate precautions should be taken as appropriate and necessary.

  • Security issues with Win7 and CS4

    In CS4, when I try to save a file to which I made a change, I get the message:

    «Cannot save N...» (title) because the file is locked. "Use the Properties command in Windows Explorer to open the file"

    Really? I have a few tens of thousands of files that, if I want to add a layer and save it, I must return to the bridge, look in Solution Explorer, click Properties, and change "All Users" for total control.

    It's obscene!

    When I'm here, "Everyone" is put in evidence and the fact that the permissions read and read/execute, on the Security tab. The file is not locked so I know the area 'Read' is empty. I can change the permissions, but it's good for only that one file and when you look at the security settings in the world, "Everyone" is not listed.

    I need to find a global way around that, and I'm not. I am logged on as administrator, and I know that there is another layer of admin. Can only be invoked in the world and how? Is this the right way or is there another? Is it a Photoshop problem or a problem with the OS?

    Thank you!

    The owner must be administrators and your username must be a member of this group if you want to change the files. The Everyone group has very limited rights.

    And you must look under the safety not only of Security/Advanced/owner.

  • security issue with the virtual host

    Hello

    I use flex builder3 and php5 to run an application built in codeIgniter 1.6.3 and flex. Problem is that I have uses a virtual host to run codeigniter in the browser. My doc root is htdocs\projects\FlexPHP. Here my flex file resides. In the browser I can access by giving more url: http://localhost/projects/FlexPHP/bin-debug/FlexPHP.html

    and I access to my php application in http://flexphp/ (path: htdocs\projects\FlexPHP\src\server-script)

    I'm calling flex http service.

    < mx:HTTPService id = "phpService".
    ' URL =' http://flexphp/profile/ProfileMngr '
    resultFormat = "e4x" result = "showResult ()" useProxy = "false" showBusyCursor = "true" / > "
    < mx:Button label = "PHP call" click = "phpService.send ()" / >

    and get the following error


    [Error CPP faultString = "Error in security to access the url" faultCode = "Channel.Security.Error" faultDetail ="" Destination: DefaultHTTP "]
    to mx.rpc::AbstractInvoker / http://www.adobe.com/2006/flex/mx/internal:faultHandler () [E:\dev\3.0.x\frameworks\project s\rpc\src\mx\rpc\AbstractInvoker.as:216 ]
    at mx.rpc::Responder/fault() [E:\dev\3.0.x\frameworks\projects\rpc\src\mx\rpc\Responder.as:49]
    at mx.rpc::AsyncRequest/fault() [E:\dev\3.0.x\frameworks\projects\rpc\src\mx\rpc\AsyncRequest .as:103]
    to DirectHTTPMessageResponder / securityErrorHandler ([E:\dev\3.0.x\frameworks\projects\rpc\sr c\mx\messaging\channels\DirectHTTPChannel.as:368])
    at flash.events::EventDispatcher/dispatchEventFunction()
    at flash.events::EventDispatcher/dispatchEvent()
    at flash.net::URLLoader/redirectEvent()

    I placed the cross-domain policy file in server folder script URLS are different, but it does not solve my problem.

    I tried with another virtual host that is not a codeigniter application, a simple php page that displays an xml... works correctly.

    Any help is appreciated. Thanks in advance.

    no problem on the side of flex... need to escape crossdomain.xml file in the htacess of codeigniter i.e RewriteCond $1! ^ (index\.php|images|application|uploads|robots\.txt|crossdomain\.xml) in the htaccess file.

  • MacbookProOS Xv.10.6.8 Intel Core Duo will work ok using FF 39.0 Beta5. but it will increase the security issues with a 64bitupgrade?

    Cannot afford to upgrade now, but I'm afraid that it will be less safe because of the registration of 32-bit technology. Doesn't work perfectly, but I'm also sure that someone else for a few more months when I can afford to upgrade my computer, or I should I my guitar to the Hock joint and bite the bullet? Please help me. What Miss me in Geekiness I do to enjoy. Thank you

    I wouldn't worry about the use of a 32-bit Mac with Firefox.

    Firefox for Windows is still only 32-bit program, although the 64-bit versions of Firefox are developing for Windows again.

  • Security issues with WORKSTATION

    Can someone help me I am administrator but some files say should run as admin or access denied because I'm the administrator is my computer?

    Also, security, there 'Authenticated users, SYSTEM and administrators of NAME - PC' everyone can access freely, but we need to have the permissions of the 'SPECIAL '?  I'm confused about what someone can enlighten me as to what this means same 'special permissions' and why I can even myself not "Special permissions" then who gets it and what is it for?  "Trusted Installer" is allowed special permissions and if I'm going to change or modify them, because they end up me disc locking hard integer m total is there a program I can use to recover my hard drive?

    Hello

    Here is some information on special permissions:

    http://sourcedaddy.com/Windows-7/special-permissions.html

    And how to take control of special permissions:

    http://www.mydigitallife.info/take-and-grant-full-control-permissions-and-ownership-in-Windows-7-or-Vista-right-click-menu/ (this is a difficulty for registration)

    I hope this helps.

  • Security issue with APEX LDAP authorization

    Hello
    We use LDAP authentication in our applications. Now, the ADMINISTRATOR stressed that all passwords are saved in the logs if monitor you the session apex_public_user with dbms_monitor.session_trace_enable (you define binds to true to get the parameters passed).

    Although it could be argued that a user how is allowed to run dbms_monitor should be a s/n trust, the requirement is to hide passwords in logs. To my knowledge, it is impossible to do, or am I have wrong here?

    If this is true, is the only option to use safely LDAP is for the browser authenticate directly, without going through any logic apex?

    Best regards

    Jürgen

    Hi Jürgen,

    How your custom permission of LDAP look like? You call the APEX_LDAP package? If you want to avoid the bind variable in this context to prevent their record in the trace file, you can use the V function instead. For example:

    if apex_ldap.is_member (
           p_username => :P101_USERNAME,
           p_pass     => V('P101_PASSWORD'),
           ... ) then
    

    Concerning
    Patrick
    -----------
    My Blog: http://www.inside-oracle-apex.com
    APEX Plug-Ins: http://apex.oracle.com/plugins
    Twitter: http://www.twitter.com/patrickwolf

    Published by: Patrick Wolf on November 19, 2012 14:26

Maybe you are looking for

  • [SOLVED] - Thunderbird constantly crashing, especially when you use Add Ons Manager, but sometimes just at the point where the program remained open.

    Hello I used Thunderbird earlier today, when the power is in my neighborhood. Given that the power was restored Thunderbird has been crashing early and often. I can't get the program to open unless I have rename or delete the folder "extensions" in ~

  • Outgoing calls are limited by a FDN

    All, Since today morning I am not able to make calls outgoing/incoming calls receive. It gives a message "outgoing calls are limited by the FDN. I checked under the call settings, it displays the NDR is disabled... I don't know wht happened... any he

  • Satellite A100-065 slow loading

    My laptop charge very slowly at the time, and switching between programs (e.g. internet to Excel) can be slow as well. The problem could be due to the insufficient memeory RAM or CPU? I have 1 GB of RAM and the processor is intel (R) Core 1.60 GHz. c

  • I want to change my hard drive

    I want to buy a new 1 TB internal HDD because he has a problem.  which is compatible for my model.  Please help me?

  • BI database logon account

    How can you (and where within BI) determine the database account used in OBIEE to query your database for reports and analyses? We need to check the permissions for the users of BI cannot access any sensitive data...