If tomcat is running with a SecurityManager, and a JSP uses PageContext.forward, DefaultAnnotationProcessor code can be called with untristed code on the call stack. The processAnnotations method contains the line: Field[] fields = instance.getClass().getDeclaredFields(); getDeclaredFields() is subject to security checks so this throws a java.security.AccessControlException. DefaultAnnotationProcessor is part of the code in the catlina lib directory, which is granted AllPermissions in the standard policy file. However, because there is untrusted JSP code on the stack, these permissions are not used. The call to getDeclaredFields() should be wrapped in an AccessController.doPrivileged call to avoid the exception.
This has been fixed in trunk and a patch (http://people.apache.org/~markt/patches/2008-10-27-bug46096.patch) proposed for 6.0.x
As a temporary workround, I added a java.lang.RuntimePermission for JSPs to catalina.policy. I then had a different exception: java.security.AccessControlException: access denied (java.util.PropertyPermission org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER read) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323) at java.security.AccessController.checkPermission(AccessController.java:546) at java.lang.SecurityManager.checkPermission(SecurityManager.java:532) at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1285) at java.lang.System.getProperty(System.java:688) at org.apache.jasper.runtime.BodyContentImpl.<clinit>(BodyContentImpl.java:44) at org.apache.jasper.runtime.PageContextImpl.pushBody(PageContextImpl.java:717) at org.apache.jasper.runtime.PageContextImpl.pushBody(PageContextImpl.java:707) I think the property access in BodyContentImpl also needs to run in a privileged block. Or the class should be initialized at startup. This probably should be a different bug?
Comment#2 looks like a configuration issue. The security policy already grants that permission to all code.
This has been fixed in 6.0.x and will be in 6.0.19 onwards.