[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [virgo-dev] Security in Virgo


On 22 November 2010 17:51, Glyn Normington <gnormington@xxxxxxxxxx> wrote:
> I hope you are aware of the thread context class loading support in Virgo which allows hibernate apps to be built without any dynamic imports. Essentially, any scoped application (PAR or scoped plan) gets an extra bundle generated by Virgo. This "synthetic context" bundle imports all the exports of the other bundles in the scoped application. The class loader of the synthetic context bundle is used as the TCCL when the scoped application calls out to bundles, such as hibernate, outside the scope. Then hibernate can use thread context class loading to load any of the classes of the exported packages of the bundles of the app. (Although I understand the general mechanism, I don't claim any hibernate expertise, so I'll leave it to others on the list to elaborate if necessary. ;-))

Thank you for the pointer :) So far we are still restricting ourselves
to not use anything vendor specific (at least not too specific). So I
guess the dynamic imports are a bit of a self imposed 'problem'.

> BTW there is no enhancement bug for a HttpService in Virgo, but please raise one if you would like to. We already support Tomcat via Gemini Web and we are planning to support Jetty in the next release, so HttpService won't be high priority, but someone in the community may care to implement it.

Will do.