Question

When I deploy to tomcat, I can edit the JAVA_OPTS to something like:

export JAVA_OPTS="$JAVA_OPTS -someswitch:/myotherJar.jar"

Now if I do this, this means that my spring application and myother.jar will be running in the same memory space/process?

i.e. I can write code in myotherJar.jar that can use reflection to analyze code in my spring app?

Do I just make up a switch name or is there some standard switches? Are these based on some events?

Answer 1

You can use java/tomcat security manager and policy files to give or not to give permission to running code to do reflection or other sensitive operations (io/file access, etc.).

See “Security Restrictions” on http://docs.oracle.com/javase/tutorial/reflect/ and google for “tomcat security manager” or “java security manager”.