Wrap ServiceLoader calls (via ClassLoaderService#loadJavaServices) in privileged blocks

Description

The ClassLoaderServiceImpl.loadJavaServices() caches ServiceLoader's. During the construction of a ServiceLoader the current java.security.AccessControlContext is captured if the security manager is enabled. This means that means that some applications may see use the wrong context when loading the service which would wrongly allow or deny loading the service.

Environment

None

Assignee

Unassigned

Reporter

James Perkins

Fix versions

None

Labels

None

backPortable

None

Suitable for new contributors

None

Requires Release Note

None

Pull Request

None

backportDecision

None

Components

Priority

Major
Configure