Package com.ultikits.ultitools.utils

Class SecurityPolicy

java.lang.Object
com.ultikits.ultitools.utils.SecurityPolicy
public class SecurityPolicy extends Object
Provides NO runtime constraint on class loading or reflection (GEN-07, D-12, since 6.3.0). isSafeClassName(String) and isSafeParameterType(Class) now unconditionally return true; addTrustedPackage(String) and addDangerousClass(String) are no-ops. The three name-based filter layers this class used to enforce never protected anything: they evaluated already-trusted, already-loaded classes on the framework's own classpath, not arbitrary untrusted input, and the trusted-package whitelist alone would have refused nearly every third-party module class (TRUSTED_PACKAGE_PREFIXES held no third-party package). See the package-private ClassloadFilterAudit (D-14) for what these removed layers would have refused, recorded as telemetry rather than enforced.

This class still performs plugin-scan-time JAR STRUCTURE filtering only: isSafeFileStructure(long, int) and isValidModuleJar(File) are unchanged and remain the framework's one genuine defense against a zip-bomb or oversized module JAR (ROADMAP criterion 4).

Version:
1.0.0
Author:
UltiKits Security Team

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private static final AtomicBoolean
    DEPRECATION_WARNING_LOGGED
    Fires the D-13 deprecation warning below at most once per JVM.
    private static final Logger
    LOGGER
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecurityPolicy()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    addDangerousClass(String className)
    Deprecated.
    Since 6.3.0 (GEN-07): this method no longer mutates ClassloadFilterAudit.SYSTEM_DANGEROUS_CLASSES or anything else.
    static void
    addTrustedPackage(String packagePrefix)
    Deprecated.
    Since 6.3.0 (GEN-07): this method no longer mutates ClassloadFilterAudit.TRUSTED_PACKAGE_PREFIXES or anything else.
    static String
    getSecurityPolicySummary()
    Get current security policy information.
    static boolean
    isSafeClassName(String className)
    Deprecated.
    Since 6.3.0 (GEN-07) this method is an unconditional no-op -- the three name-based classload filter layers it enforced never protected anything (they evaluated already-trusted, already-loaded classes, not arbitrary untrusted input), and the trusted-package whitelist alone would have refused nearly every third-party module class.
    static boolean
    isSafeFileStructure(long fileSize, int entryCount)
    Validate file size and structure for security.
    static boolean
    isSafeParameterType(Class<?> clazz)
    Deprecated.
    Since 6.3.0 (GEN-07), for the same reason as isSafeClassName(String) -- its only in-tree caller (the seven-argument PluginManager.register/with-args reflective-construction path) was deleted by GEN-04, which is what dissolved this method's former "shared-field, can't safely delete the whitelist" objection.
    static boolean
    isValidModuleJar(File jarFile)
    Validate that a module JAR is safe to hand to a classloader: it must exist, be a regular file, have a .jar suffix (case-insensitive), open as a readable archive, and pass the size/entry-count limits enforced by isSafeFileStructure(long, int).
    private static void
    logSecurityViolation(String reason, String details)
    Log security violation for monitoring and audit purposes.
    private static void
    warnDeprecatedNoOp()
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • LOGGER

      private static final Logger LOGGER

    • DEPRECATION_WARNING_LOGGED

      private static final AtomicBoolean DEPRECATION_WARNING_LOGGED
      Fires the D-13 deprecation warning below at most once per JVM. Guards against the measured call volume: isSafeClassName was reached from two PluginManager scan loops, each capped at 1000 classes per JAR -- up to 2000 calls per module JAR, roughly 28,000 per startup with fourteen modules. A naive per-call warning would flood startup.

  • Constructor Details

    • SecurityPolicy

      public SecurityPolicy()

  • Method Details

    • warnDeprecatedNoOp

      private static void warnDeprecatedNoOp()

    • isSafeClassName

      @Deprecated(since="6.3.0") public static boolean isSafeClassName(String className)
      Deprecated.
      Since 6.3.0 (GEN-07) this method is an unconditional no-op -- the three name-based classload filter layers it enforced never protected anything (they evaluated already-trusted, already-loaded classes, not arbitrary untrusted input), and the trusted-package whitelist alone would have refused nearly every third-party module class. The signature is retained because it is public static on a published class and cannot be removed without breaking a downstream caller's compile. See the package-private ClassloadFilterAudit for what these removed layers would have refused, now recorded as telemetry.
      Formerly validated whether a class name was safe to load; unconditionally returns true now, including for a null or blank input (GEN-07 empty-input edge -- this differs from the pre-6.3.0 behavior, which returned false for both).
      Parameters:
      className - class name to validate, ignored
      Returns:
      true, unconditionally

    • isSafeParameterType

      @Deprecated(since="6.3.0") public static boolean isSafeParameterType(Class<?> clazz)
      Deprecated.
      Since 6.3.0 (GEN-07), for the same reason as isSafeClassName(String) -- its only in-tree caller (the seven-argument PluginManager.register/with-args reflective-construction path) was deleted by GEN-04, which is what dissolved this method's former "shared-field, can't safely delete the whitelist" objection.
      Formerly validated whether a parameter type was safe for reflection operations; unconditionally returns true now, including for a null input (GEN-07 empty-input edge -- this differs from the pre-6.3.0 behavior, which returned false).
      Parameters:
      clazz - parameter class, ignored
      Returns:
      true, unconditionally

    • isSafeFileStructure

      public static boolean isSafeFileStructure(long fileSize, int entryCount)
      Validate file size and structure for security.
      Parameters:
      fileSize - file size in bytes
      entryCount - number of entries in archive
      Returns:
      true if safe, false otherwise

    • isValidModuleJar

      public static boolean isValidModuleJar(File jarFile)
      Validate that a module JAR is safe to hand to a classloader: it must exist, be a regular file, have a .jar suffix (case-insensitive), open as a readable archive, and pass the size/entry-count limits enforced by isSafeFileStructure(long, int).

      This is a static, instance-free rule with no dependency on Bukkit — it must be callable before the plugin's onEnable() has built any manager, and from a plain JUnit test with no server running. Callers are responsible for skipping (not adding) a JAR this method rejects; this method never throws for a JAR it judges unsafe, it only returns false.

      Parameters:
      jarFile - candidate module jar file
      Returns:
      true if the jar may be handed to a classloader, false otherwise
      Since:
      6.3.0

    • addTrustedPackage

      @Deprecated(since="6.3.0") public static void addTrustedPackage(String packagePrefix)
      Deprecated.
      Since 6.3.0 (GEN-07): this method no longer mutates ClassloadFilterAudit.TRUSTED_PACKAGE_PREFIXES or anything else. The signature is retained because it is public static on a published class.
      Formerly added a trusted package prefix at runtime; now a no-op that does not mutate anything (GEN-07, D-12) -- ClassloadFilterAudit.TRUSTED_PACKAGE_PREFIXES reflects exactly the shipped list, never a caller's runtime addition, so the audit measures the framework as released.
      Parameters:
      packagePrefix - package prefix, ignored

    • addDangerousClass

      @Deprecated(since="6.3.0") public static void addDangerousClass(String className)
      Deprecated.
      Since 6.3.0 (GEN-07): this method no longer mutates ClassloadFilterAudit.SYSTEM_DANGEROUS_CLASSES or anything else. The signature is retained because it is public static on a published class.
      Formerly added a class to the dangerous-class blacklist at runtime; now a no-op that does not mutate anything (GEN-07, D-12) -- ClassloadFilterAudit.SYSTEM_DANGEROUS_CLASSES reflects exactly the shipped list, never a caller's runtime addition.
      Parameters:
      className - class name, ignored

    • logSecurityViolation

      private static void logSecurityViolation(String reason, String details)
      Log security violation for monitoring and audit purposes.
      Parameters:
      reason - violation reason
      details - violation details

    • getSecurityPolicySummary

      public static String getSecurityPolicySummary()
      Get current security policy information.
      Returns:
      security policy summary