Skip to Main Content
Forums

Java Development Tools

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Interested in getting your voice heard by members of the Developer Marketing team at Oracle? Check out this post for AppDev or this post for AI focus group information.

Jdev 12.1.3: JBO-25152: Calling the constructor for class oracle.jbo.server.SequenceImpl is not perm

Jose ArósteguiJul 8 2014 — edited Jul 10 2014

Hi experts,

Something really unexpected is happening. This is my first EO created after I've migrated my project from 12.1.2 to 12.1.3 and using the usual procedure to generate the table id via a db_sequence with:

(new oracle.jbo.server.SequenceImpl("NAME_SEQ", adf.object.getDBTransaction())).getSequenceNumber()

I'm getting this error when I test the AM in the AM Tester:

oracle.jbo.jbotester.app.ErrorHandler$ExceptionWrapper: startup failed:


General error during semantic analysis: JBO-25152: Calling the constructor for class oracle.jbo.server.SequenceImpl is not permitted.






oracle.jbo.ExprSecurityException: JBO-25152: Calling the constructor for class oracle.jbo.server.SequenceImpl is not permitted.


  at oracle.jbo.script.InternalSecurityPolicyEnforcer.checkConstructor(InternalSecurityPolicyEnforcer.java:304)


  at oracle.jbo.script.ExprASTScanningVisitor.visitConstructorCallExpression(ExprASTScanningVisitor.java:127)


  at org.codehaus.groovy.ast.expr.ConstructorCallExpression.visit(ConstructorCallExpression.java:44)


  at org.codehaus.groovy.ast.CodeVisitorSupport.visitListOfExpressions(CodeVisitorSupport.java:273)


  at org.codehaus.groovy.ast.CodeVisitorSupport.visitTupleExpression(CodeVisitorSupport.java:178)


  at org.codehaus.groovy.ast.expr.TupleExpression.visit(TupleExpression.java:76)


  at org.codehaus.groovy.ast.CodeVisitorSupport.visitMethodCallExpression(CodeVisitorSupport.java:131)


  at oracle.jbo.script.ExprASTScanningVisitor.visitMethodCallExpression(ExprASTScanningVisitor.java:142)


  at org.codehaus.groovy.ast.expr.MethodCallExpression.visit(MethodCallExpression.java:64)


  at org.codehaus.groovy.ast.CodeVisitorSupport.visitListOfExpressions(CodeVisitorSupport.java:273)


  at org.codehaus.groovy.ast.CodeVisitorSupport.visitTupleExpression(CodeVisitorSupport.java:178)

I'm starting to think that it's been reckless to migrate to 12.1.3 so quick :-(

Thanks in advance,
Jose.

Comments

Jose Aróstegui

Please find a simple test case with HR Schema here:

https://dl.dropboxusercontent.com/u/18609389/TestSequenceError.zip

Thanks!

Jose Aróstegui

Hi,


I've reproduced the same test case in Jdev 12.1.2 and everything works fine. The main difference between the EO.xml is that 12.1.3 adds trustMode:

<TransientExpression trustMode="untrusted">


               <![CDATA[(new oracle.jbo.server.SequenceImpl("DEPARTMENTS_SEQ", adf.object.getDBTransaction())).getSequenceNumber()]]>


</TransientExpression>

Which seems to be the reason of the exception. Any idea why?

Regards,

Jose.

Timo Hahn

You are right. The normal operation to set the PK with a sequence via a groovy expression does not work any longer.

And yes the reason is the added trustMode="untrusted property. If you look at the error message for the exception

JBO-25152: Calling the constructor for class {0} is not permitted.

Cause: An attempt was made within an untrusted expression to call a constructor not on the list of allowed constructors.


Action:Add the constructor to the list of allowed constructors in adf-config.xml.

Level: 1


Type: ERROR


Impact: Security

it suggests that you can add the constructor (not sure which one) to the allowed constructors. I have not found any information on this, bit I'll see what comes up when I log a bug with your test case.

Timo

Message was edited by: Timo Hahn --------------------------------------------------------------------------------------------------------- Workaround: edit the trustMode property for the attribute and set it to 'trusted'

1 person found this helpful
Timo Hahn

Added https://java.net/jira/browse/ADFEMG-241 for this

Timo

kdario

It seems that expressions are executed by default in untrusted mode.

So you should change trustMode="untrusted"  to "trusted"(in xml or through Property Inspector).

If you invoke java method from expression then you can also use @AllowUntrustedScriptAccess annotation on such method.

Dario

User_HWHT9

I've bounced this issue internally to at the very least get it documented, if not more, will update the ADFEMG issue once I have an update.

Chris Muir

Oracle ADF Product Management

Jose Aróstegui

Thanks everybody for your help. This forum is great :-)

Jose Aróstegui

... I guess I deserve some points for my status, no? :-)

1 - 8
Locked Post
New comments cannot be posted to this locked post.

Post Details

Locked on Aug 7 2014
Added on Jul 8 2014
#application-development-in-java, #jdeveloper-and-adf
8 comments
5,263 views