Wrap more security related reflection in AccessController

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713356 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/SignatureFacet.java b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/SignatureFacet.java
index 21922fe1c7f4f3357bb93e4cfe5bde9a702a7426..43bef872fd7b62b7b29b87b2905c46037c2337f1 100644 (file)
--- a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/SignatureFacet.java
+++ b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/facets/SignatureFacet.java
@@ -26,8 +26,10 @@ package org.apache.poi.poifs.crypt.dsig.facets;
 \r
 import java.lang.reflect.Field;\r
 import java.lang.reflect.Method;\r
+import java.security.AccessController;\r
 import java.security.GeneralSecurityException;\r
 import java.security.MessageDigest;\r
+import java.security.PrivilegedAction;\r
 import java.security.Provider;\r
 import java.security.Security;\r
 import java.util.List;\r
@@ -50,6 +52,7 @@ import org.apache.poi.poifs.crypt.dsig.SignatureConfig;
 import org.apache.poi.poifs.crypt.dsig.SignatureConfig.SignatureConfigurable;\r
 import org.apache.poi.util.POILogFactory;\r
 import org.apache.poi.util.POILogger;\r
+import org.apache.poi.util.SuppressForbidden;\r
 import org.w3c.dom.Document;\r
 \r
 /**\r
@@ -156,25 +159,32 @@ public abstract class SignatureFacet implements SignatureConfigurable {
     }\r
     \r
     // helper method ... will be removed soon\r
-    public static void brokenJvmWorkaround(Reference reference) {\r
-        DigestMethod digestMethod = reference.getDigestMethod();\r
-        String digestMethodUri = digestMethod.getAlgorithm();\r
+    public static void brokenJvmWorkaround(final Reference reference) {\r
+        final DigestMethod digestMethod = reference.getDigestMethod();\r
+        final String digestMethodUri = digestMethod.getAlgorithm();\r
         \r
-        // workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012\r
-        // overwrite standard message digest, if a digest <> SHA1 is used\r
-        Provider bcProv = Security.getProvider("BC");\r
+        final Provider bcProv = Security.getProvider("BC");\r
         if (bcProv != null && !DigestMethod.SHA1.equals(digestMethodUri)) {\r
-            try {\r
-                Method m = DOMDigestMethod.class.getDeclaredMethod("getMessageDigestAlgorithm");\r
-                m.setAccessible(true);\r
-                String mdAlgo = (String)m.invoke(digestMethod);\r
-                MessageDigest md = MessageDigest.getInstance(mdAlgo, bcProv);\r
-                Field f = DOMReference.class.getDeclaredField("md");\r
-                f.setAccessible(true);\r
-                f.set(reference, md);\r
-            } catch (Exception e) {\r
-                LOG.log(POILogger.WARN, "Can't overwrite message digest (workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012)", e);\r
-            }\r
+            // workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012\r
+            // overwrite standard message digest, if a digest <> SHA1 is used\r
+            AccessController.doPrivileged(new PrivilegedAction<Void>() {\r
+                @Override\r
+                @SuppressForbidden("Workaround for a bug, needs access to private JDK members (may fail in Java 9): https://bugzilla.redhat.com/show_bug.cgi?id=1155012")\r
+                public Void run() {\r
+                    try {\r
+                        Method m = DOMDigestMethod.class.getDeclaredMethod("getMessageDigestAlgorithm");\r
+                        m.setAccessible(true);\r
+                        String mdAlgo = (String)m.invoke(digestMethod);\r
+                        MessageDigest md = MessageDigest.getInstance(mdAlgo, bcProv);\r
+                        Field f = DOMReference.class.getDeclaredField("md");\r
+                        f.setAccessible(true);\r
+                        f.set(reference, md);\r
+                    } catch (Exception e) {\r
+                        LOG.log(POILogger.WARN, "Can't overwrite message digest (workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1155012)", e);\r
+                    }\r
+                    return null; // Void\r
+                }\r
+            });\r
         }\r
     }\r
 }
\ No newline at end of file