Re: RFR: 8319332: Security properties files inclusion [v7]

2024-05-01 Thread Martin Balao
On Fri, 19 Apr 2024 13:02:03 GMT, Francisco Ferrari Bihurriet wrote: >>> In the compatibility risk description of the CSR: >>> >>> > In line with the efforts to check invalid URLs (see >>> > [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL >>> > public constructors),

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-22 Thread Martin Balao
On Fri, 19 Apr 2024 19:40:53 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Fri, 19 Apr 2024 19:40:53 GMT, Weijun Wang wrote: > Yes, I can see its effect on the relative include. Maybe use the deprecated > URL constructor as a fallback when the other mechanisms fail? Yes, that's what we have in mind. We will try to handle it as a local path and when not possible, w

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Fri, 19 Apr 2024 13:19:44 GMT, Weijun Wang wrote: > > > > Is it worth breaking such invalid URLs? > > I'm just not sure about the compatibility impact. The example > "file:///C:\some\path\extra.properties" you gave looks quite innocent and > could be generated by a casual script. > > Can t

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 13:31:42 GMT, Francisco Ferrari Bihurriet wrote: >> Oh, I meant the final `else`. What does it mean if a file is neither >> "regular" nor "directory"? Also I don't quite understand why one uses >> `toRealPath` and one uses `toAbsolutePath`. Is this related to resolving a >

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Fri, 19 Apr 2024 13:02:27 GMT, Weijun Wang wrote: >> Hi @wangweij, to complement @martinuy's answer, the following commands can >> trigger this error message in the different described contexts: >> >> java -Djava.security.properties=file:///etc >> -XshowSettings:security:properties -Djava.s

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 13:02:03 GMT, Francisco Ferrari Bihurriet wrote: > > > Is it worth breaking such invalid URLs? I'm just not sure about the compatibility impact. The example "file:///C:\some\path\extra.properties" you gave looks quite innocent and could be generated by a casual script. Ca

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Fri, 19 Apr 2024 08:16:34 GMT, Martin Balao wrote: >> In the compatibility risk description of the CSR: >>> In line with the efforts to check invalid URLs (see >>> [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL >>> public constructors), "java.security.properties" f

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 12:58:32 GMT, Francisco Ferrari Bihurriet wrote: >> src/java.base/share/classes/java/security/Security.java line 256: >> >>> 254: } else if (Files.isDirectory(path)) { >>> 255: throw new IOException("Is a directory"); >>> 256: } else {

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Wed, 17 Apr 2024 14:30:02 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:55:05 GMT, Weijun Wang wrote: > In the compatibility risk description of the CSR: > > > In line with the efforts to check invalid URLs (see > > [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL > > public constructors), "java.security.properties"

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:30:02 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:28:58 GMT, Weijun Wang wrote: > "If a system property does not have a value, it expands to the empty string." > What's the benefit? It will be nice if you can include an example on the CSR. Expanding to the empty string has the advantage that we can parameterize part of

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-17 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-17 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-03-06 Thread Francisco Ferrari Bihurriet
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-03-06 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga