Security context

Highlights

Privilege Escalation: 5 prior fixes. Scrutinize any change in this area.

core/src/main/java/org/jboss/logmanager/LogContext.java: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Privilege Escalation: Creating Logger instances and initializing logging levels can fail or be blocked when invoked by sandboxed code unless properly wrapped inside AccessController.doPrivileged blocks. Ensuring consistent privileged execution prevents SecurityExceptions in restrictive environments.

Auth Bypass: Privileged administrative operations, such as adding or setting context close handlers, were accessible to unauthorized code due to missing Java SecurityManager permission checks. Enforcement of CONTROL_PERMISSION is mandatory.

Privilege Escalation: Using Class.forName with dynamic loaders requires a privileged execution context to ensure successful execution under restrictive security managers. Failure to isolate these calls prevents legitimate logging classes from being initialized properly.