Uploaded image for project: 'CDI Specification Issues'
  1. CDI Specification Issues
  2. CDI-702

Observers in CDI extensions can see classes they should not be able to

    Details

    • Type: Clarification
    • Status: Open (View Workflow)
    • Priority: Critical
    • Resolution: Unresolved
    • Affects Version/s: 1.2.Final, 1.1.Final, 2.0 .Final
    • Fix Version/s: None
    • Component/s: Portable Extensions
    • Labels:
      None

      Description

      We observe a undesired behavior on Weld, which is during CDI bootstrap, all classes from both the EAR lib folder and all WAR lib folders are available to CDI extensions in the EAR lib folder as well as to CDI extensions in all WAR lib folders. Basically, the extension class can see everything in an .ear regardless where the extension class resides. It completely ignores classloading hierarchy.
      e.g.

      myApp.ear
      lib\myLib.jar (LibExtensionA.class, LibOne.class)
      myWarA.war (WarAExtension.class, myWarAServlet.class)
      myWarB.war (WarBExtension.class, myWarBServlet.class)

      In this example,LibExtensionA, WarAExtension and WarBExtension can observe the classes of
      LibOne, myWarAServlet and myWarBServlet.

      This kind of contradicts with the classloading rules, where separate .war archives packaged under the same .ear should not be able to see each other's class by default, unless they both use the same classloader.

      We discussed with Weld dev team (Martin, Thomas, Matej) and Anotine. The feedback is that CDI spec is unclear on the "observer resolution". I would like to relaunch the discussion to make this clarified and fixed. Please comment.

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                emilyj Emily Jiang
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated: