On Thu, 3 Sep 2026 14:11:01 GMT, Francisco Ferrari Bihurriet
<[email protected]> wrote:
>> Sean Mullan has updated the pull request with a new target base due to a
>> merge or a rebase. The pull request now contains 43 commits:
>>
>> - Merge
>> - Add test for modular image using customized java.security file.
>> Add other various improvements and tests for different property syntax.
>> - Use Properties API to parse each property.
>> Add method to determine if props file has comments or blank lines.
>> Add method to determine if property is multi-lined value.
>> Store props in Properties object instead of Map.
>> - Add extract method to JModTask.
>> - Revert change made to java.security file.
>> - Support lines of just whitespace.
>> - Support all delimiters ('=', ':', whitespace)
>> - Use ISO_8859_1 to read/write property files.
>> Improve SkippedException message.
>> - Alternate jlink --security-properties implementation. There is no separate
>> option for the include file.
>> - Document that comments in the properties file are ignored.
>> - ... and 33 more: https://git.openjdk.org/jdk/compare/9c6e2f49...55f102ed
>
> src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/SecurityPropertiesPlugin.java
> line 146:
>
>> 144: if (propValue != null) {
>> 145: // override value
>> 146: lines.add(propName + "=" + propValue);
>
> `propName` and `propValue` raw values are passed unescaped, this will work
> for ISO-8859-1 characters, but will fail for Unicode characters greater than
> `\u00FF`, backward slashes, spaces in keys, and idented or multi-line values.
>
> For example, if the file passed as `--security-properties` contains
> properties with `\` or `\u20AC`, `extraProps` will have them parsed as `` or
> `€`. When writing to the ISO-8859-1 byte array, the backward slash will be
> stored as a single slash (which the `Properties` parser discards) and the
> Euro sign as a question mark.
>
> Perhaps we can use [`Properties.store(OutputStream out, String
> comments)`](https://docs.oracle.com/en/java/javase/26/docs/api/java.base/java/util/Properties.html#store(java.io.OutputStream,java.lang.String))
> in a similar way as you did with `Properties.load()` (one property at a
> time). It handles the escaping properly, the only caveat is it will require
> removing the header date comment and a trailing newline:
>
>
> jshell -<<'EOF'
> Properties test = new Properties();
> test.put("aaa", "euro_\u20AC_value");
> test.put("abb", "slash_\_value");
> test.put("euro_\u20AC_key", "111");
> test.put("slash_\_key", "222");
> test.put("spaced key", "333");
> test.put("zyy", " indented value");
> test.put("zzz", "multi-line\nvalue");
> test.list(System.out);
>
> System.out.println("-- showing Properties.store() result --")
> ByteArrayOutputStream bao = new ByteArrayOutputStream();
> test.store(bao, null);
> System.out.println(bao.toString(StandardCharsets.ISO_8859_1));
> EOF
>
>
> Output:
>
>
> -- listing properties --
> aaa=euro_€_value
> abb=slash__value
> euro_€_key=111
> slash__key=222
> spaced key=333
> zyy= indented value
> zzz=multi-line
> value
> -- showing Properties.store() result --
> #Thu Sep 03 16:07:22 CEST 2026
> aaa=euro_\u20AC_value
> abb=slash_\_value
> euro_\u20AC_key=111
> slash_\_key=222
> spaced\ key=333
> zyy=\ indented value
> zzz=multi-line\nvalue
>
>
>
> The core escaping logic is in
> [`Properties.saveConvert()`](https://github.com/openjdk/jdk/blob/e9222ab58987711adafd598a01b7ad58ab25f895/src/java.base/share/classes/java/util/Properties.java#L682-L738).
> For the [JDK-8319332: Security properties files
> inclusion](https://bugs.openjdk.org/browse/JDK-8319332) test, we implemented
> [a simplified version](https://github....
Oh the joy of character encodings :)
Yes, this is absolutely a valid issue. Let me experiment a bit with
`Properties.store` to see if I can make it work - otherwise that looks like a
smaller piece of code that is more manageable as a copy/paste for now.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/31884#discussion_r3927816449
