...
| Wiki Markup |
|---|
\[[Gong 03|AA. Java References#Gong 03]\] Section 4.3.2, Class Loader Delegation Hierarchy
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 6-2 Safely invoke standard APIs that bypass SecurityManager checks depending on the immediate caller's class loader
\[[Tomcat 09|AA. Java References#Tomcat 09]\] [Bug ID 29936|https://issues.apache.org/bugzilla/show_bug.cgi?id=29936], API Class {{org.apache.tomcat.util.digester.Digester}}, [Security fix in v 6.0.20|http://tomcat.apache.org/security-6.html]
\[[CVE 08|AA. Java References#CVE 08]\] [CVE-2009-0783|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0783] |
...
SEC14SEC03-J. Provide sensitive mutable classes with unmodifiable wrappersDo not allow tainted variables in doPrivileged blocks 02. Platform Security (SEC) SEC06SEC05-J. Do not use expose standard APIs that perform access checks against use the immediate caller's class loader instance to untrusted code