Correct 2 problems:

1. getContextClassLoader is priviledged, protect for J2EE environs.
2. getContextClassLoader can & does return null.  Code wasn't
    checking for this properly.


git-svn-id: https://svn.apache.org/repos/asf/jakarta/commons/proper/logging/trunk@138913 13f79535-47bb-0310-9956-ffa450edef68

src/java/org/apache/commons/logging/LogFactory.java

@@ -1,7 +1,7 @@
 /*
- * $Header: /home/jerenkrantz/tmp/commons/commons-convert/cvs/home/cvs/jakarta-commons//logging/src/java/org/apache/commons/logging/LogFactory.java,v 1.11 2002/08/12 21:01:07 rsitze Exp $
+ * $Header: /home/jerenkrantz/tmp/commons/commons-convert/cvs/home/cvs/jakarta-commons//logging/src/java/org/apache/commons/logging/LogFactory.java,v 1.12 2002/08/30 03:23:34 rsitze Exp $
- * $Revision: 1.11 $
+ * $Revision: 1.12 $
- * $Date: 2002/08/12 21:01:07 $
+ * $Date: 2002/08/30 03:23:34 $
  *
  * ====================================================================
  *
@@ -62,16 +62,17 @@
 package org.apache.commons.logging;
 
 
-import java.io.InputStream;
-import java.io.IOException;
 import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.Enumeration;
 import java.util.Hashtable;
 import java.util.Properties;
-import java.lang.SecurityException;
 
 
 /**
@@ -85,7 +86,7 @@ import java.lang.SecurityException;
  *
  * @author Craig R. McClanahan
  * @author Costin Manolache
- * @version $Revision: 1.11 $ $Date: 2002/08/12 21:01:07 $
+ * @version $Revision: 1.12 $ $Date: 2002/08/30 03:23:34 $
  */
 
 public abstract class LogFactory {
@@ -258,7 +259,13 @@ public abstract class LogFactory {
     public static LogFactory getFactory() throws LogConfigurationException {
 
         // Identify the class loader we will be using
-        ClassLoader contextClassLoader = getContextClassLoader();
+        ClassLoader contextClassLoader =
+            (ClassLoader)AccessController.doPrivileged(
+                new PrivilegedAction() {
+                    public Object run() {
+                        return getContextClassLoader();
+                    }
+                });
 
         // Return any previously registered factory for this class loader
         LogFactory factory = getCachedFactory(contextClassLoader);
@@ -323,8 +330,9 @@ public abstract class LogFactory {
         // system property )
 
         try {
-            InputStream stream =
+            InputStream stream = (contextClassLoader == null
-                contextClassLoader.getResourceAsStream(FACTORY_PROPERTIES);
+                                 ? ClassLoader.getSystemResourceAsStream( FACTORY_PROPERTIES )
+                                 : contextClassLoader.getResourceAsStream( FACTORY_PROPERTIES ));
             if (stream != null) {
                 props = new Properties();
                 props.load(stream);
@@ -498,9 +506,6 @@ public abstract class LogFactory {
         if (contextClassLoader != null)
             factory = (LogFactory) factories.get(contextClassLoader);
         
-        if (factory==null)
-            factory = (LogFactory) factories.get(LogFactory.class.getClassLoader());
-        
         return factory;
     }
     

src/java/org/apache/commons/logging/impl/LogFactoryImpl.java

@@ -1,7 +1,7 @@
 /*
- * $Header: /home/jerenkrantz/tmp/commons/commons-convert/cvs/home/cvs/jakarta-commons//logging/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java,v 1.13 2002/08/09 18:47:34 rsitze Exp $
+ * $Header: /home/jerenkrantz/tmp/commons/commons-convert/cvs/home/cvs/jakarta-commons//logging/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java,v 1.14 2002/08/30 03:23:34 rsitze Exp $
- * $Revision: 1.13 $
+ * $Revision: 1.14 $
- * $Date: 2002/08/09 18:47:34 $
+ * $Date: 2002/08/30 03:23:34 $
  *
  * ====================================================================
  *
@@ -64,13 +64,15 @@ package org.apache.commons.logging.impl;
 
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Method;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.Enumeration;
 import java.util.Hashtable;
 import java.util.Vector;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogConfigurationException;
 import org.apache.commons.logging.LogFactory;
-import org.apache.commons.logging.LogSource;
 
 
 /**
@@ -104,7 +106,7 @@ import org.apache.commons.logging.LogSource;
  *
  * @author Rod Waldhoff
  * @author Craig R. McClanahan
- * @version $Revision: 1.13 $ $Date: 2002/08/09 18:47:34 $
+ * @version $Revision: 1.14 $ $Date: 2002/08/30 03:23:34 $
  */
 
 public class LogFactoryImpl extends LogFactory {
@@ -435,23 +437,42 @@ public class LogFactoryImpl extends LogFactory {
 
     }
 
-    /** Load a class, try first the thread class loader, and
+    /**
-        if it fails use the loader that loaded this class
+     * <p>** MUST KEEP THIS METHOD PRIVATE **
-    */
+     * </p>
-    static Class loadClass( String name )
+     * 
+     * <p>This method uses <code>AccessController.doPrivileged()</code>.
+     * </p>
+     * 
+     * Load a class, try first the thread class loader, and
+     * if it fails use the loader that loaded this class.
+     */  
+    private static Class loadClass( final String name )
         throws ClassNotFoundException
     {
-        ClassLoader threadCL = getContextClassLoader();
+        Object result = AccessController.doPrivileged(
+            new PrivilegedAction() {
+                public Object run() {
+                    ClassLoader threadCL = getContextClassLoader();
+                    if (threadCL != null) {
+                        try {
+                            return threadCL.loadClass(name);
+                        } catch( ClassNotFoundException ex ) {
+                            // ignore
+                        }
+                    }
+                    try {
+                        return Class.forName( name );
+                    } catch (ClassNotFoundException e) {
+                        return e;
+                    }
+                }
+            });
 
-        if (threadCL != null) {
+        if (result instanceof Class)
-            try {
+            return (Class)result;
-                return threadCL.loadClass(name);
-            } catch( ClassNotFoundException ex ) {
-                return Class.forName( name );
-            }
-        }
 
-        return null;
+        throw (ClassNotFoundException)result;
     }
 
     protected void guessConfig() {