[jcifs] More classloader issues

[Glass, Eric]

> > 
> > So if jcifs.http.NtlmFilter is placed in both the system 
> AND webapp class
> > paths, it will be loaded by the system classloader (somewhat
> > counterintuitively, and contradictory to Tomcat's documentation on
> > classloading at
> > 
> >
http://jakarta.apache.org/tomcat/tomcat-4.1-doc/class-loader-howto.html).
> > I'm not sure if this is technically a bug, in that this implementation
does
> > satisfy the spec -- J2SE and Servlet API classes cannot be overridden by
web
> > applications.  It just doesn't work in our case because the servlet API
> > classes aren't visible to the system classloader.
>
> I don't understand. If someone rolls the jcifstomcat.jar with
> the jcifs.http package in it into their WAR file and put the
> jcifs-x.x.x.jar file in their container CLASSPATH then .... ? I think
> it will work based on what you just said. Presumably they would not put
> javax.servlet.HttpFilter in the WAR file and even if they did it is a
> Java servlet API class. What is in danger of being loaded inappropriately
> in this case?

Basically, Tomcat enforces the requirement that web apps can't override J2SE
classes by attempting to load classes via the System classloader first; if
you put the jar in both the system classpath and the web application
classpath, Tomcat will ignore the copy in WEB-INF/lib.  This leads to the
same behavior as the case when jCIFS is located only in the system classpath
(it finds jcifs.http.NtlmHttpFilter using the system classloader, then can't
locate javax.servlet.Filter because it's not in the system classloader).
The Tomcat documentation indicates that it should look for classes in the
following order:

WebApp -> Shared -> Common -> System

But an inspection of the Tomcat code reveals that it actually does:

System -> WebApp -> Shared -> Common

Which means that any jar placed in both the system classpath and WEB-INF/lib
will only be loaded from the system classpath -- the WEB-INF/lib copy will
be ignored completely.

Eric


> 
> Eric
>  
> **************************************************************************
> The information transmitted herewith is sensitive information intended
only
> for use by the individual or entity to which it is addressed. If the
reader
> of this message is not the intended recipient, you are hereby notified
that
> any review, retransmission, dissemination, distribution, copying or other
> use of, or taking of any action in reliance upon this information is
> strictly prohibited. If you have received this communication in error,
> please contact the sender and delete the material from your computer.


-- 
A  program should be written to model the concepts of the task it
performs rather than the physical world or a process because this
maximizes  the  potential  for it to be applied to tasks that are
conceptually  similar and, more important, to tasks that have not
yet been conceived. 
 
**************************************************************************
The information transmitted herewith is sensitive information intended only
for use by the individual or entity to which it is addressed. If the reader
of this message is not the intended recipient, you are hereby notified that
any review, retransmission, dissemination, distribution, copying or other
use of, or taking of any action in reliance upon this information is
strictly prohibited. If you have received this communication in error,
please contact the sender and delete the material from your computer.