On Wed, 16 Sep 2026 01:02:58 GMT, Joe Wang <[email protected]> wrote:
>> Refer to the CSR, this is the implementation for the Resource.Access >> property. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Joe Wang has updated the pull request incrementally with one additional > commit since the last revision: > > test: fix system id src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java line 1367: > 1365: if (!fISCreatedByResolver) { > 1366: String accessError = > SecuritySupport.checkAccess(expandedSystemId, fSecurityManager, > 1367: XMLConstants.ACCESS_EXTERNAL_DTD, > fAccessExternalDTD); Would it be possible to say how this works with HTTP redirects? I can't tell if expandedSystemId is the original URL or the "final" URL in this check. I think my guess is really asking if the value of jdk.xml.resource.access needs to allow both the original and the final URL. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r4052564271
