8353641: Deprecate core library permission classes for removal #24444

RogerRiggs · 2025-04-04T12:37:32Z

Now that the Security Manager is permanently disabled, the following permission classes in the core libraries area can be deprecated for removal as they are no longer useful: FilePermission, LinkPermission, LoggingPermission, PropertyPermission, ReflectPermission, RuntimePermission, and SerializablePermission

@deprecated(forRemoval = true, since="25")
Is added to each class and the existing @APinote is converted to @deprected

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8353728 to be approved

Issues

JDK-8353641: Deprecate core library permission classes for removal (Enhancement - P3)
JDK-8353728: Deprecate core library permission classes for removal (CSR)

Reviewers

Iris Clark (@irisclark - Reviewer) Review applies to bb18c1e6
Sean Mullan (@seanjmullan - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/24444/head:pull/24444
$ git checkout pull/24444

Update a local copy of the PR:
$ git checkout pull/24444
$ git pull https://git.openjdk.org/jdk.git pull/24444/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 24444

View PR using the GUI difftool:
$ git pr show -t 24444

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/24444.diff

Using Webrev

Link to Webrev Comment

@deprecated

Now that the Security Manager is permanently disabled, the following permission classes in the core libraries area can be deprecated for removal as they are no longer useful: FilePermission, LinkPermission, LoggingPermission, PropertyPermission, ReflectPermission, RuntimePermission, and SerializablePermission @deprecated(forRemoval = true, since="25") Is added to each class and the existing @APinote is converted to @deprected

RogerRiggs · 2025-04-04T12:37:54Z

/csr

bridgekeeper · 2025-04-04T12:38:22Z

👋 Welcome back rriggs! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-04-04T12:38:45Z

@RogerRiggs This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8353641: Deprecate core library permission classes for removal

Reviewed-by: mullan, iris

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 90 new commits pushed to the master branch:

e50af6d: 8354090: Refactor import warning suppression in Check.java
c4c3edf: 8341402: BigDecimal's square root optimization
7e69b98: 8350441: ZGC: Overhaul Page Allocation
... and 87 more: https://git.openjdk.org/jdk/compare/0d4d1558164bb352aa4f7be1fffb7eb2da506944...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-04-04T12:39:19Z

@RogerRiggs has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@RogerRiggs please create a CSR request for issue JDK-8353641 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

openjdk · 2025-04-04T12:39:56Z

@RogerRiggs The following labels will be automatically applied to this pull request:

core-libs
net
nio
security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-04-04T12:44:02Z

Webrevs

dfuch · 2025-04-04T12:53:05Z

Looks reasonable to me. Changes to LoggingPermission look good. Out of curiosity I also looked at all usages of RuntimePermission in the JDK - I believe you caught them all - including the unexpected use in XSLT.

…ations `since` comes before `forRemoval` No spaces around `=`

seanjmullan · 2025-04-04T19:05:35Z

Some copyright dates have not been updated.

seanjmullan · 2025-04-04T19:07:59Z

src/java.base/share/classes/sun/net/www/protocol/file/FileURLConnection.java

        return is;
    }

+    @SuppressWarnings("removal")


This should not be necessary.

seanjmullan · 2025-04-04T19:10:33Z

src/java.logging/share/classes/java/util/logging/LoggingPermission.java

 *
 */

+@Deprecated(forRemoval = true, since="25")


This order is different than other classes, maybe make it consistent?

seanjmullan · 2025-04-04T19:11:42Z

src/java.base/share/classes/java/io/FilePermission.java

 */

+@Deprecated(since="25", forRemoval=true)
+@SuppressWarnings("removal")


Is this leftover? You already add it to the methods that need it.

… style

AlanBateman · 2025-04-07T06:46:28Z

src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java

     * kill threads. Lazily constructed.
     */
+    @SuppressWarnings("removal")
    static volatile RuntimePermission modifyThreadPermission;


This can be removed, it's not used.

@SuppressWarnings

…missions, URLClassLoader.getPermissions. Remove dead code from ForkJoinPool. Add @SuppressWarnings("remove")

…r.getPermissions, URLClassLoader.getPermissions." SecureClassLoader.getPermissions and URLClassLoader.getPermissions are not marked as Deprecated.

src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java

src/java.base/share/classes/jdk/internal/access/JavaIOFilePermissionAccess.java

RogerRiggs · 2025-04-10T19:19:01Z

/integrate

openjdk · 2025-04-10T19:19:32Z

Going to push as commit af5db51.
Since your change was applied there have been 96 commits pushed to the master branch:

60f3d60: 8351110: ImageIO.write for JPEG can write corrupt JPEG for certain thumbnail dimensions
dc249be: 8350462: MethodTypeForm.LF_INTERPRET can cache the MemberName instead
799e5b3: 8354071: Add LintCategory property indicating whether @SuppressWarnings is supported
... and 93 more: https://git.openjdk.org/jdk/compare/0d4d1558164bb352aa4f7be1fffb7eb2da506944...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-04-10T19:19:43Z

@RogerRiggs Pushed as commit af5db51.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

openjdk bot added rfr Pull request is ready for review csr Pull request needs approved CSR before integration labels Apr 4, 2025

openjdk bot added security security-dev@openjdk.org nio nio-dev@openjdk.org core-libs core-libs-dev@openjdk.org net net-dev@openjdk.org labels Apr 4, 2025

RogerRiggs added 2 commits April 4, 2025 12:36

Add SuppressWarnings to a Windows source missed earlier.

1fa560a

Updated style of @deprecated to match most existing @deprecated annot…

bb18c1e

…ations `since` comes before `forRemoval` No spaces around `=`

irisclark approved these changes Apr 4, 2025

View reviewed changes

Remove unused import of LinkPermission

25aa609

Update copyright in WindowsFileCopy

c145749

seanjmullan reviewed Apr 4, 2025

View reviewed changes

Remove unnecessary SuppressWarnings and correct Deprecated annotation…

9a9417a

… style

AlanBateman reviewed Apr 7, 2025

View reviewed changes

RogerRiggs added 4 commits April 7, 2025 13:07

Mark as deprecated for removal as of jdk 25: SecureClassLoader.getPer…

322c593

…missions, URLClassLoader.getPermissions. Remove dead code from ForkJoinPool. Add @SuppressWarnings("remove")

Missing suppresswarnings

ecd4ec0

Merge branch 'master' into 8353641-deprecate-premission-classes

009b420

Revert "Mark as deprecated for removal as of jdk 25: SecureClassLoade…

6d3f003

…r.getPermissions, URLClassLoader.getPermissions." SecureClassLoader.getPermissions and URLClassLoader.getPermissions are not marked as Deprecated.

openjdk bot removed the csr Pull request needs approved CSR before integration label Apr 7, 2025

AlanBateman reviewed Apr 8, 2025

View reviewed changes

src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java Show resolved Hide resolved

AlanBateman reviewed Apr 8, 2025

View reviewed changes

src/java.base/share/classes/jdk/internal/access/JavaIOFilePermissionAccess.java Show resolved Hide resolved

seanjmullan approved these changes Apr 10, 2025

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Apr 10, 2025

openjdk bot added the integrated Pull request has been integrated label Apr 10, 2025

openjdk bot closed this Apr 10, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Apr 10, 2025

8353641: Deprecate core library permission classes for removal #24444

8353641: Deprecate core library permission classes for removal #24444

Uh oh!

Conversation

RogerRiggs commented Apr 4, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewing

Uh oh!

RogerRiggs commented Apr 4, 2025

Uh oh!

bridgekeeper bot commented Apr 4, 2025

Uh oh!

openjdk bot commented Apr 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Apr 4, 2025

Uh oh!

openjdk bot commented Apr 4, 2025

Uh oh!

mlbridge bot commented Apr 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

dfuch commented Apr 4, 2025

Uh oh!

seanjmullan commented Apr 4, 2025

Uh oh!

seanjmullan Apr 4, 2025

Choose a reason for hiding this comment

Uh oh!

seanjmullan Apr 4, 2025

Choose a reason for hiding this comment

Uh oh!

seanjmullan Apr 4, 2025

Choose a reason for hiding this comment

Uh oh!

AlanBateman Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

RogerRiggs commented Apr 10, 2025

Uh oh!

openjdk bot commented Apr 10, 2025

Uh oh!

openjdk bot commented Apr 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

RogerRiggs commented Apr 4, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Apr 4, 2025 •

edited

Loading

mlbridge bot commented Apr 4, 2025 •

edited

Loading