On Thu, 30 Jul 2026 13:47:57 GMT, Alan Bateman <[email protected]> wrote:
>> Joe Wang has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> address jar spec change
>
> src/java.xml/share/classes/jdk/xml/internal/AccessRule.java line 246:
>
>> 244: // Port
>> 245: int portSep = hostPart.lastIndexOf(':');
>> 246: if (portSep > 0 && portSep < hostPart.length() - 1
>
> Can you check this for the case that the hostname is followed by ":" without
> a port?
A check is added now (line 200); Added a test case as well.
> src/java.xml/share/classes/jdk/xml/internal/AccessRule.java line 436:
>
>> 434: if (isDirectory) {
>> 435: // Path starts with this directory
>> 436: return testPath.startsWith(pattern + "/") ||
>> testPath.equals(pattern);
>
> Is startsWith sufficient here? I would assume testPath needs to be filtered
> first for ".." and other dangerous elements.
I added an opaque check at line 238 so that the match applies only to
hierarchical URIs. Dot-segments are valid URI syntax so normalizing won't
remove them, but the current prefix/exact-match logic already rejects them
unless the pattern itself explicitly contains them.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r3692356980
PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r3692346766
