(sling-org-apache-sling-xss) branch master updated: SLING-12930 - XSS API fails to build and run with Java 25 due to missing Unsafe.ensureClassInitialized (#57)

[rombert]

This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git


The following commit(s) were added to refs/heads/master by this push:
     new 1e4c051  SLING-12930 - XSS API fails to build and run with Java 25 due 
to missing Unsafe.ensureClassInitialized (#57)
1e4c051 is described below

commit 1e4c0511e252ea21b114861277c1e5faece701b8
Author: Robert Munteanu <romb...@apache.org>
AuthorDate: Fri Sep 5 15:07:59 2025 +0200

    SLING-12930 - XSS API fails to build and run with Java 25 due to missing 
Unsafe.ensureClassInitialized (#57)
    
    Fallback to MethodHandles.Lookup for initialising the class if the Unsafe 
method does not work.
    
    This API is available as of Java 15 so as long as we support Java 11 we 
cannot rely on it
    exclusively.
---
 .../org/apache/sling/xss/impl/AntiSamyPolicyAdapter.java   | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/apache/sling/xss/impl/AntiSamyPolicyAdapter.java 
b/src/main/java/org/apache/sling/xss/impl/AntiSamyPolicyAdapter.java
index 2028305..e524fbc 100644
--- a/src/main/java/org/apache/sling/xss/impl/AntiSamyPolicyAdapter.java
+++ b/src/main/java/org/apache/sling/xss/impl/AntiSamyPolicyAdapter.java
@@ -18,7 +18,10 @@
  */
 package org.apache.sling.xss.impl;
 
+import java.lang.invoke.MethodHandles;
+import java.lang.invoke.MethodHandles.Lookup;
 import java.lang.reflect.Field;
+import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -247,13 +250,20 @@ public class AntiSamyPolicyAdapter {
             Field guards = 
HtmlPolicyBuilder.class.getDeclaredField("ATTRIBUTE_GUARDS");
 
             // although it looks distasteful, the 'sun.misc.Unsafe' approach 
is the only one that
-            // works with Java 8 through 17 .
+            // works with Java 8 through 21
             Field f = Unsafe.class.getDeclaredField("theUnsafe");
             f.setAccessible(true);
             Unsafe unsafe = (Unsafe) f.get(null);
 
             // required to be able to get the static field base
-            unsafe.ensureClassInitialized(HtmlPolicyBuilder.class);
+            try {
+                unsafe.ensureClassInitialized(HtmlPolicyBuilder.class);
+            } catch (NoSuchMethodError uoe) {
+                // fallback for Java 22+, see 
https://bugs.openjdk.org/browse/JDK-8316160
+                Lookup lookup = MethodHandles.lookup();
+                Method ensureInitialized = 
Lookup.class.getDeclaredMethod("ensureInitialized", Class.class);
+                ensureInitialized.invoke(lookup, HtmlPolicyBuilder.class);
+            }
 
             Object fieldBase = unsafe.staticFieldBase(guards);
             long fieldOffset = unsafe.staticFieldOffset(guards);