On Tue, 25 Aug 2026 07:56:23 GMT, Sergey Bylokhov <[email protected]> wrote:
> > It is still being done, albeit with a constraint of a system property > > registering an "allow-list", as the ability to launch applications > > directly, without restraint, carries a high risk of being misused. > > But it still contradicts the spec for all versions, and it is unclear how the > name of the property "awt.desktop.browse_insecure" is directly related to the > behavior specified by the method. > > When that change was made, was it actually considered that this was the > by-design behavior of the method? Or was it simply missed based on the "peers > description" and we now have this regression? We need to adapt the API impl. based on how it gets misused..We have already reviewed this internally and was agreed upon. @prrace Do we need to update the spec of Desktop.browse() in any way for this change? ------------- PR Comment: https://git.openjdk.org/jdk/pull/32247#issuecomment-5407651792
