This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 13815 - Security exception from disabled TimerBean instance
Summary: Security exception from disabled TimerBean instance
Status: CLOSED DUPLICATE of bug 18312
Alias: None
Product: guibuilder
Classification: Unclassified
Component: Code (show other bugs)
Version: 3.x
Hardware: PC Linux
: P3 blocker (vote)
Assignee: issues@guibuilder
: 13895 (view as bug list)
Depends on: 14024
  Show dependency tree
Reported: 2001-07-23 14:04 UTC by Jesse Glick
Modified: 2003-06-30 18:30 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Exception Reporter:

AccessControlException from timerbean instance (1.59 KB, text/plain)
2001-07-23 14:05 UTC, Jesse Glick

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Glick 2001-07-23 14:04:35 UTC
[dev jul 21] While turning off form editor, got security exception from
timerbean. Seems to be harmless.
Comment 1 Jesse Glick 2001-07-23 14:05:15 UTC
Created attachment 1933 [details]
AccessControlException from timerbean instance
Comment 2 Tomas Pavek 2001-07-25 18:09:41 UTC
*** Issue 13895 has been marked as a duplicate of this issue. ***
Comment 3 Tomas Pavek 2001-07-25 18:15:05 UTC
It is not harmless - the Timer bean is quite unusable (e.g. dev build 
20010725). When instantiated (e.g. be InstanceDataObject), it tries 
to start its thread - but this fails on security restriction (see the 
exception). Some security policy must have been changed, as this 
worked so far...

Opinion of core?
Comment 4 Jan Zajicek 2001-07-27 15:34:32 UTC
This one depends on 14024.
Comment 5 Jan Zajicek 2001-09-07 13:29:07 UTC
Comment 6 anovak 2001-09-07 14:04:30 UTC
The bug is in InstanceNode.initName it MUST NOT ever call instanceCreate.
Comment 7 Jesse Glick 2001-09-26 20:38:52 UTC
I guess looking at this, it seems that (1) yes InstanceNode should
avoid creating the instance if it can in fact avoid it, at least for
performance reasons; (2) the security exception is correct - code
loaded from a user filesystem cannot be trusted and should run in a
sandbox; (3) the TimerBean is probably mostly to blame for starting a
thread in its constructor, which is not very polite behavior for a
bean IMHO: a bean to be used at design time should cause no
side-effects just by construction; in this case it should do nothing
until start() is called on it. Since (1) is already being worked on
and (2) is I think correct, I would vote for this bug to be reassigned
to the Form Editor for shipping an impolite example.
Comment 8 Jan Pokorsky 2001-09-27 12:01:11 UTC
I agree. I see two possible solutions. (1) fix the TimerBean behavior 
as Jesse proposed, (2) define TimerBean in a module layer + annotate 
the file with SystemFileSystem.localizedBundle. It would be greate to 
do both.

Reassigned to the Form Editor.
Comment 9 Jan Chalupa 2001-11-27 12:38:27 UTC
Target milestone -> 3.3.1.
Comment 10 Tomas Pavek 2001-12-03 18:00:29 UTC
I've made a TASK issue 18312 for tracking rewrite of "beans 
autoloading", Timer bean placement and behavior, and related issues 
(which I don't think to be Form Editor bugs in 3.3).

*** This issue has been marked as a duplicate of 18312 ***
Comment 11 Tomas Pavek 2002-04-08 17:14:07 UTC
Timer bean has just been changed - starts no more in ctor.
Comment 12 Quality Engineering 2003-06-30 18:20:29 UTC
Resolved for 3.3.x or earlier, no new info since then -> closing.
Comment 13 Quality Engineering 2003-06-30 18:30:16 UTC
Resolved for 3.3.x or earlier, no new info since then -> closing.