Finding Out Directories on current File System! 2005-04-06 - By Joe Sam Shirah
Back
Hi Ben,
> > J2EE apps should not assume that a file system even exists.
>
> Why not? It would be a little strange if there wasn't a filesystem.
I'm technically wrong, so let me clarify:
The J2EE spec states that the minimal security permissions set an app
can expect includes
java.io.FilePermission read,write
I really was thinking of EJB's, although some of the considerations
should be kept in mind. Here's the explanation from
<
http://java.sun.com/blueprints/guidelines/designing_enterprise_applications/ejb
_tier/qanda/restrictions.html
>
"Why can't EJBs read and write files and directories in the filesystem? And
why can't they access file descriptors?
Enterprise beans aren't allowed to access files primarily because files are
not transactional resources. Allowing EJBs to access files or directories in
the filesystem, or to use file descriptors, would compromise component
distributability, and would be a security hazard.
Another reason is deployability. The EJB container can choose to place an
enterprise bean in any JVM, on any machine in a cluster. Yet the contents of
a filesystem are not part of a deployment, and are therefore outside of the
EJB container's control. File systems, directories, files, and especially
file descriptors tend to be machine-local resources. If an enterprise bean
running in a JVM on a particular machine is using or holding an open file
descriptor to a file in the filesystem, that enterprise bean cannot easily
be moved from one JVM or machine to another, without losing its reference to
the file.
Furthermore, giving EJBs access to the filesystem is a security hazard,
since the enterprise bean could potentially read and broadcast the contents
of sensitive files, or even upload and overwrite the JVM runtime binary for
malicious purposes.
Files are not an appropriate mechanism for storing business data for use by
components, because they tend to be unstructured, are not under the control
of the server environment, and typically don't provide distributed
transactional access or fine-grained locking. Business data is better
managed using a persistence interface such as JDBC, whose implementations
usually provide these benefits. Read-only data can, however, be stored in
files in a deployment JAR, and accessed with the getResource() or
getResourceAsStream() methods of java.lang.Class."
Sorry for any confusion.
Joe Sam
Joe Sam Shirah - http://www.conceptgo.com
conceptGO - Consulting/Development/Outsourcing
Java Filter Forum: http://www.ibm.com/developerworks/java/
Just the JDBC FAQs: http://www.jguru.com/faq/JDBC
Going International? http://www.jguru.com/faq/I18N
Que Java400? http://www.jguru.com/faq/Java400
-- -- Original Message -- --
From: "Ben Hill" <ben@(protected)>
To: <J2EE-INTEREST@(protected)>
Sent: Wednesday, April 06, 2005 1:09 PM
Subject: Re: Finding Out Directories on current File System!
> > J2EE apps should not assume that a file system even exists.
>
> Why not? It would be a little strange if there wasn't a filesystem.
>
>
===========================================================================
To unsubscribe, send email to listserv@(protected) and include in the body
of the message "signoff J2EE-INTEREST". For general help, send email to
listserv@(protected) and include in the body of the message "help".
|
|
