Bug fix. Only the bootstrap class loader is allowed to define classes in the java package.

4 files changed, 42 insertions, 4 deletions

diff --git a/ikvmc/CompilerClassLoader.cs b/ikvmc/CompilerClassLoader.cs
index f12d59cd..23b938dd 100644
--- a/ikvmc/CompilerClassLoader.cs
+++ b/ikvmc/CompilerClassLoader.cs
@@ -71,8 +71,9 @@ namespace IKVM.Internal
 		private List<TypeWrapper> dynamicallyImportedTypes = new List<TypeWrapper>();
 		private List<string> jarList = new List<string>();
 		private List<TypeWrapper> allwrappers;
+		private bool compilingCoreAssembly;
 
-		internal CompilerClassLoader(AssemblyClassLoader[] referencedAssemblies, CompilerOptions options, FileInfo assemblyPath, bool targetIsModule, string assemblyName, Dictionary<string, Jar.Item> classes)
+		internal CompilerClassLoader(AssemblyClassLoader[] referencedAssemblies, CompilerOptions options, FileInfo assemblyPath, bool targetIsModule, string assemblyName, Dictionary<string, Jar.Item> classes, bool compilingCoreAssembly)
 			: base(options.codegenoptions, null)
 		{
 			this.referencedAssemblies = referencedAssemblies;
@@ -82,6 +83,7 @@ namespace IKVM.Internal
 			this.assemblyFile = assemblyPath.Name;
 			this.assemblyDir = assemblyPath.DirectoryName;
 			this.targetIsModule = targetIsModule;
+			this.compilingCoreAssembly = compilingCoreAssembly;
 			Tracer.Info(Tracer.Compiler, "Instantiate CompilerClassLoader for {0}", assemblyName);
 		}
 
@@ -2566,7 +2568,7 @@ namespace IKVM.Internal
 				{
 					if (c.Shadows != null && c.Name == "java.lang.Object")
 					{
-						return true;
+						return compilingCoreAssembly = true;
 					}
 				}
 			}
@@ -2870,7 +2872,7 @@ namespace IKVM.Internal
 				}
 				referencedAssemblies[i] = acl;
 			}
-			loader = new CompilerClassLoader(referencedAssemblies, options, options.path, options.targetIsModule, options.assembly, h);
+			loader = new CompilerClassLoader(referencedAssemblies, options, options.path, options.targetIsModule, options.assembly, h, compilingCoreAssembly);
 			loader.classesToCompile = new List<string>(h.Keys);
 			if(options.remapfile != null)
 			{
@@ -3328,6 +3330,14 @@ namespace IKVM.Internal
 		{
 			get { return options.noParameterReflection; }
 		}
+
+		protected override void CheckProhibitedPackage(string className)
+		{
+			if (!compilingCoreAssembly)
+			{
+				base.CheckProhibitedPackage(className);
+			}
+		}
 	}
 
 	sealed class Jar
diff --git a/runtime/AssemblyClassLoader.cs b/runtime/AssemblyClassLoader.cs
index f8179021..5560ad59 100644
--- a/runtime/AssemblyClassLoader.cs
+++ b/runtime/AssemblyClassLoader.cs
@@ -1308,6 +1308,10 @@ namespace IKVM.Internal
 			return base.GetWrapperFromAssemblyType(type);
 		}
 
+		protected override void CheckProhibitedPackage(string className)
+		{
+		}
+
 #if !FIRST_PASS && !STATIC_COMPILER && !STUB_GENERATOR
 		internal override java.lang.ClassLoader GetJavaClassLoader()
 		{
diff --git a/runtime/ClassLoaderWrapper.cs b/runtime/ClassLoaderWrapper.cs
index 2b892918..b3317493 100644
--- a/runtime/ClassLoaderWrapper.cs
+++ b/runtime/ClassLoaderWrapper.cs
@@ -353,6 +353,14 @@ namespace IKVM.Internal
 		}
 #endif // !STATIC_COMPILER && !STUB_GENERATOR
 
+		protected virtual void CheckProhibitedPackage(string className)
+		{
+			if (className.StartsWith("java.", StringComparison.Ordinal))
+			{
+				throw new SecurityException("Prohibited package name: " + className.Substring(0, className.LastIndexOf('.')));
+			}
+		}
+
 #if !STUB_GENERATOR
 		internal TypeWrapper DefineClass(ClassFile f, ProtectionDomain protectionDomain)
 		{
@@ -380,6 +388,7 @@ namespace IKVM.Internal
 				return RegisterInitiatingLoader(tw);
 			}
 #endif
+			CheckProhibitedPackage(f.Name);
 			// check if the class already exists if we're an AssemblyClassLoader
 			if(FindLoadedClassLazy(f.Name) != null)
 			{
diff --git a/runtime/JavaException.cs b/runtime/JavaException.cs
index e41fad72..3a3869bb 100644
--- a/runtime/JavaException.cs
+++ b/runtime/JavaException.cs
@@ -1,5 +1,5 @@
 /*
-  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007 Jeroen Frijters
+  Copyright (C) 2002-2014 Jeroen Frijters
 
   This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any damages
@@ -216,3 +216,18 @@ sealed class UnsupportedClassVersionError : ClassFormatError
 	}
 #endif
 }
+
+sealed class SecurityException : RetargetableJavaException
+{
+	internal SecurityException(string msg)
+		: base(msg)
+	{
+	}
+
+#if !STATIC_COMPILER && !FIRST_PASS && !STUB_GENERATOR
+	internal override Exception ToJava()
+	{
+		return new java.lang.SecurityException(Message);
+	}
+#endif
+}