Community
Participate
Working Groups
For weaving, OSGi has defined a weave action. To mutate a WovenClass object, the caller must have AdminPermission with the weave action for the bundle whose class is being woven.
WovenClassImpl needs to check the caller has the proper permission in the setBytes method. Also, the list returned by getDynamicImports must check the caller has proper permission on the mutation methods.
Created attachment 187576 [details] patch Note that this patch depends on the patch in 334582 to get the new WEAVE constant from AdminPermission.
Also note that I added the permission check to WovenClassImpl.getBytes when weaving has not completed yet since this is the actual raw byte[] that will be used to define the class and can be manipulated directly by the hook. I opened osgi bug https://www.osgi.org/members/bugzilla/show_bug.cgi?id=1864 to clarify that this is required by the specification.
patch released.