Page History

...

As an example of what constitutes the immediate caller and the object, consider the method {{java.lang.Class.newInstance()}}. Here, the immediate caller is the class that contains this method call whereas the object on which the {{newInstance()}} method is being invoked is referred to as the {{Class}} object ({{classObjectName.newInstance()}}). According to the Java Language Specification \[[JLS 2005|AA. Bibliography#JLS 05]\], Section 4.3.2, "The Class {{Object}}": "The method {{getClass}} returns the {{Class}} object that represents the class of the object."  

If a security manager is present, untrusted code that does not have the permissions to use the API directly is disallowed from indirectly using trusted code containing the API call, to perform the operation. However, the security manager checks are bypassed if the class loader of the immediate caller is the same as or the delegation ancestor of the class loader of the object on which the API is invoked. Consequently, untrusted callers who do not have the required permissions but are capable of passing the class loader check, are able to perform sensitive operations if the trusted code invokes these APIs on their behalf.

...

Care must be taken when using these APIs. In particular, trusted code should not accept Class objects from untrusted code for further use. For example, if trusted code is loaded by the bootstrap class loader, it can create an instance of a sensitive system class by using the the newInstance() method on the Class object. If the method that creates the instance is visible to untrusted code, no security manager checks are carried out to prohibit the untrusted code from indirectly creating the class instance (untrusted code must pass the class loader comparison check).

...

protected static Digester webDigester = null;

if(webDigester == null){
  webDigester = createWebDigester();
}

// This method exists in the class DigesterFactory and is called by ContextConfig.createWebXmlDigester() 
// which is in turn called by ContextConfig.createWebDigester()
// webDigester finally contains the value of digester defined in this method
public static Digester newDigester(boolean xmlValidation, boolean xmlNamespaceAware, RuleSet rule) {
  Digester digester = new Digester();
  // ...
  digester.setUseContextClassLoader(true);
  // ...
  return digester;
}

// Digester.getParser() calls this method. It is defined in class Digester
public SAXParserFactory getFactory() {
  if (factory == null) {
    factory = SAXParserFactory.newInstance(); // Uses WebappClassLoader
    // ...
  }
  return (factory);
}

...

public ClassLoader getClassLoader() {
  // ...
  if(this.useContextClassLoader) {
    // Uses the context class loader which was previously set to the WebappClassLoader
    ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); 
  }
  return classloader;
}

Similarly, the contextDigester processing is also broken in the affected versions.

...