PACL- java.lang.SecurityException: Attempted to get environment name *

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2, 6.2.0 CE M4
• Fix Version/s: 6.1.2 CE GA3, 6.1.30 EE GA3, 6.2.0 CE M4
• Component/s: Accessibility, Application Security > PACL, Security Vulnerability
• Labels:
  • QA-R
  • liferay-fixpack-pacl-1-6120
• Environment: Any with PACL enabled
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Epic/Theme:
  • Platform
• Fix Priority: 5

Whenever, in a plugin with PACL enabled, a call is made to:

System.getenv()

a permission is check is made using RuntimePermission("getenv.*")

This results in an exception something like:

13:42:56,069 ERROR [pool-2-thread-9][HotDeployImpl:191] com.liferay.portal.kernel.deploy.hot.HotDeployException: Error registering portlets for xxxxxxxxxxx-portlet
com.liferay.portal.kernel.deploy.hot.HotDeployException: Error registering portlets for xxxxxxxxxxx-portlet
at com.liferay.portal.kernel.deploy.hot.BaseHotDeployListener.throwHotDeployException(BaseHotDeployListener.java:46)
at com.liferay.portal.deploy.hot.PortletHotDeployListener.invokeDeploy(PortletHotDeployListener.java:123)
at com.liferay.portal.deploy.hot.HotDeployImpl.doFireDeployEvent(HotDeployImpl.java:188)
at com.liferay.portal.deploy.hot.HotDeployImpl.fireDeployEvent(HotDeployImpl.java:96)
at com.liferay.portal.kernel.deploy.hot.HotDeployUtil.fireDeployEvent(HotDeployUtil.java:27)
at com.liferay.portal.kernel.servlet.PluginContextListener.fireDeployEvent(PluginContextListener.java:151)
at com.liferay.portal.kernel.servlet.SecurePluginContextListener.fireDeployEvent(SecurePluginContextListener.java:233)
at com.liferay.portal.kernel.servlet.PluginContextListener.doPortalInit(PluginContextListener.java:141)
at com.liferay.portal.kernel.util.BasePortalLifecycle.portalInit(BasePortalLifecycle.java:42)
at com.liferay.portal.kernel.util.PortalLifecycleUtil.register(PortalLifecycleUtil.java:64)
at com.liferay.portal.kernel.util.PortalLifecycleUtil.register(PortalLifecycleUtil.java:56)
at com.liferay.portal.kernel.util.BasePortalLifecycle.registerPortalLifecycle(BasePortalLifecycle.java:52)
at com.liferay.portal.kernel.servlet.PluginContextListener.contextInitialized(PluginContextListener.java:103)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4779)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5273)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:895)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:871)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:615)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1099)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1621)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:619)
Caused by: java.lang.SecurityException: Attempted to get environment name *
at com.liferay.portal.security.pacl.checker.BaseChecker.throwSecurityException(BaseChecker.java:259)
at com.liferay.portal.security.pacl.checker.RuntimeChecker.checkPermission(RuntimeChecker.java:104)
at com.liferay.portal.security.pacl.ActivePACLPolicy.checkPermission(ActivePACLPolicy.java:55)
at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:103)
at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:74)
at java.lang.System.getenv(System.java:877)
at org.springframework.core.env.AbstractEnvironment.getSystemEnvironment(AbstractEnvironment.java:304)
at org.springframework.core.env.StandardEnvironment.customizePropertySources(StandardEnvironment.java:79)
at org.springframework.web.portlet.context.StandardPortletEnvironment.customizePropertySources(StandardPortletEnvironment.java:89)
at org.springframework.core.env.AbstractEnvironment.<init>(AbstractEnvironment.java:101)
at org.springframework.core.env.StandardEnvironment.<init>(StandardEnvironment.java:54)
at org.springframework.web.portlet.context.StandardPortletEnvironment.<init>(StandardPortletEnvironment.java:46)
at org.springframework.web.portlet.GenericPortletBean.<init>(GenericPortletBean.java:79)
at org.springframework.web.portlet.FrameworkPortlet.<init>(FrameworkPortlet.java:103)
at org.springframework.web.portlet.DispatcherPortlet.<init>(DispatcherPortlet.java:136)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at java.lang.Class.newInstance0(Class.java:355)
at java.lang.Class.newInstance(Class.java:308)
at com.liferay.portlet.PortletBagFactory.create(PortletBagFactory.java:131)
at com.liferay.portal.deploy.hot.PortletHotDeployListener.initPortlet(PortletHotDeployListener.java:546)
at com.liferay.portal.deploy.hot.PortletHotDeployListener.doInvokeDeploy(PortletHotDeployListener.java:321)
at com.liferay.portal.deploy.hot.PortletHotDeployListener.invokeDeploy(PortletHotDeployListener.java:120)

Similar errors will result from calls to

System.getenv(String name)