Will check.

On Jul 30, 2013, at 4:37 PM, Stuart Douglas <notifications@github.com> wrote:

> In ee/src/main/java/org/jboss/as/ee/concurrent/handle/SecurityContextHandleFactory.java:
> 
> > +    public ContextHandle saveContext(ContextService contextService, Map<String, String> contextObjectProperties) {
> > +        return new SecurityContextHandle();
> > +    }
> > +
> > +    @Override
> > +    public Type getType() {
> > +        return Type.Security;
> > +    }
> > +
> > +    private static class SecurityContextHandle implements ContextHandle {
> > +
> > +        private final SecurityContext securityContext;
> > +        private SecurityContext previous;
> > +
> > +        private SecurityContextHandle() {
> > +            this.securityContext = SecurityContextAssociation.getSecurityContext();
> 
> This may cause problems if a security manager is present, if any of the SecurityContextAssociation methods are called with user code on the call stack (which I think they will be, as they are run inside the interceptor chain).
> 
> —
> Reply to this email directly or view it on GitHub.
>