replacing ORB in 1.2beta4 broken by security changes

Nick Reeves (nickr@harlequin.co.uk)
Fri, 24 Jul 1998 13:59:52 +0100

Date: Fri, 24 Jul 1998 13:59:52 +0100
Message-Id: <199807241259.NAA09729@spot.cam.harlequin.co.uk>
From: Nick Reeves <nickr@harlequin.co.uk>
To: javaidl@ics.eng.sun.com, java-security@java.sun.com
Subject: replacing ORB in 1.2beta4 broken by security changes

It seems that the replaceable ORB feature no longer works in 1.2beta4
unless the ORB classes are included in the JRE.

1.2 Introduced the ability to replace the ORBs by setting the System
Properties

org.omg.CORBA.ORBClass
org.omg.CORBA.ORBSingletonClass

I successfully used this feature in 1.2beta3 but find that this no
longer works in 1.2beta4. The point of failure is in

org.omg.CORBA.ORB.create_impl()

When I set org.omg.CORBA.ORBClass to point to my class the
Class.forName in create_impl now fails with a ClassNotFoundException
even though the same invocation of Class.forName succeeds from one of
my classes.

I am assuming this is a new security feature to stop system classes
being overridden.

The reason I am sending this as an email rather than raising a bug is
that I am unclear whether this change is intentional or it is a regression.

-- 
Nick Reeves