8353642: Deprecate URL::getPermission method and networking permission classes for removal #24592

dfuch · 2025-04-11T09:00:05Z

Please find her a patch that deprecate networking permission classes for removal. The method URL::getPermission now serves little purpose and is also deprecated. That method was overridden in subclasses and specified to return some of the deprecated permissions.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8354406 to be approved

Issues

JDK-8353642: Deprecate URL::getPermission method and networking permission classes for removal (Enhancement - P3)
JDK-8354406: Deprecate URL::getPermission method and networking permission classes for removal (CSR)

Reviewers

Michael McMahon (@Michael-Mc-Mahon - Reviewer) Review applies to d47a31d1
Daniel Jeliński (@djelinski - Reviewer)
Iris Clark (@irisclark - Reviewer)
Sean Mullan (@seanjmullan - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/24592/head:pull/24592
$ git checkout pull/24592

Update a local copy of the PR:
$ git checkout pull/24592
$ git pull https://git.openjdk.org/jdk.git pull/24592/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 24592

View PR using the GUI difftool:
$ git pr show -t 24592

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/24592.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-04-11T09:00:50Z

👋 Welcome back dfuchs! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-04-11T09:01:41Z

@dfuch This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8353642: Deprecate URL::getPermission method and networking permission classes for removal

Reviewed-by: djelinski, iris, mullan, michaelm

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 53 new commits pushed to the master branch:

8128f63: 8355692: Refactor stream indentation
f5525ec: 8348410: Preview flag not checked during compilation resulting in runtime crash
7ae52ce: 8356390: Rename ResolvedIndyEntry::set_flags to set_has_appendix
... and 50 more: https://git.openjdk.org/jdk/compare/c6ffacb5754642083f614a5ee6dc76b7d145c605...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-04-11T09:03:09Z

@dfuch The following labels will be automatically applied to this pull request:

net
nio
security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-04-11T09:06:27Z

Webrevs

dfuch · 2025-04-11T09:55:58Z

The CSR is also ready to be reviewed at https://bugs.openjdk.org/browse/JDK-8354406

djelinski · 2025-04-11T10:45:20Z

src/java.base/share/classes/java/net/HttpURLConnection.java

+     * {@link UnsupportedOperationException}, or return
+     * {@link java.security.AllPermission}.
     */
+    @Deprecated(since = "25")


can this (and all other getPermission methods) be "forRemoval=true"?

Possibly. @AlanBateman may have some thoughts on this.

I think we should at least consider deprecating URLConnection.getPermission and HttpURLConnection.getPermission for removal, only because I don't immediately see the advantage of doing it in two steps for these two APIs.

Thanks - I will do that then

djelinski · 2025-04-11T10:55:10Z

src/java.base/share/classes/java/security/CodeSource.java

                }
-                return this.sp.implies(that.sp);
+                @SuppressWarnings("removal")
+                var result = this.sp.implies(that.sp);


Will we need to rewrite this code without SocketPermissions? Can we remove it, maybe? It is only used by CodeSource.implies, which is not used by the JDK (but may be used elsewhere).

also the JavaDoc of the implies method references the SocketPermission. That will also need to be cleaned up at some point.

That will be left over for someone in security-libs to cleanup this code at their convenience before we remove SocketException.

Hmmm... If the public API references SocketException we might have to deprecate in this PR too. Not sure what the implications are. Maybe @seanjmullan can advise.

djelinski · 2025-04-11T11:16:48Z

src/java.base/share/classes/java/net/SocketPermission.java

 */

+@SuppressWarnings("removal")
+@Deprecated(since = "25", forRemoval = true)


this class is internal, no need to deprecate

It helps getting warnings at the place where the class is used.

djelinski · 2025-04-11T12:01:52Z

The GHA failure (Windows) appears to be related.

dfuch · 2025-04-11T12:31:04Z

The GHA failure (Windows) appears to be related.

Yes - I missed one windows specific file in my original patch. I have a test running in the CI and I am waiting for it to pass before updating the PR.

Michael-Mc-Mahon · 2025-04-11T13:47:10Z

src/java.base/share/classes/java/security/CodeSource.java

                if (this.sp == null) {
-                    this.sp = new SocketPermission(thisHost, "resolve");
+                    @SuppressWarnings("removal")
+                    var _ = this.sp = new SocketPermission(thisHost, "resolve");


What's the reason for the var _ = bit ?

@SuppressWarnings can not be applied to a an expression - it needs a (variable/method/class) declaration

dfuch · 2025-04-11T13:57:35Z

The GHA failure (Windows) appears to be related.

Should be fixed now

Michael-Mc-Mahon

Looks fine to me.

djelinski

LGTM.

dfuch · 2025-05-08T16:10:26Z

After discussion with @seanjmullan we decided to revert the changes to SocketPermission and CodeSource from this PR. Deprecation of SocketPermission will be the object of another RFE (JDK-8356557) - once we have decided what to do with CodeSource::implies.

seanjmullan · 2025-05-09T16:34:34Z

src/java.base/share/classes/sun/net/www/protocol/file/FileURLConnection.java

     * relevant
     */
+    @Override
+    @Deprecated(since = "25", forRemoval = true)


Is this annotation required or more as a reminder that the superclass method is deprecated?

I think it's needed because the superclass method is deprecated for removal. Will double check.

Yes - it is needed. If you override a deprecated method you need to carry the deprecation annotation over. Here is what I got when I tried to remove the annotation on HttpURLConnection::getPermission() (the same error occurred on any subclass where I attempted to remove the annotation):

java/net/HttpURLConnection.java:615: warning: [dep-ann] deprecated item is not annotated with @Deprecated public Permission getPermission() throws IOException { ^ error: warnings found and -Werror specified

seanjmullan · 2025-05-09T16:42:31Z

src/java.base/share/classes/java/net/HttpURLConnection.java

+     * as the Security Manager is no longer supported.
     */
+    @Deprecated(since = "25", forRemoval = true)
+    @SuppressWarnings("removal")


Do you still need this annotation now that SocketPermission is not deprecated for removal?

Ah - good point - I will double check.

Yes - it is needed as well. Apparently if you override a deprecated method you need both @Deprecated and @SuppressWarning:

src/java.base/share/classes/java/net/HttpURLConnection.java:615: warning: [removal] getPermission() in URLConnection has been deprecated and marked for removal public Permission getPermission() throws IOException { ^ error: warnings found and -Werror specified

Ok, but seems redundant.

dfuch · 2025-05-12T16:48:15Z

/integrate

openjdk · 2025-05-12T16:49:43Z

Going to push as commit 45dfc2c.
Since your change was applied there have been 56 commits pushed to the master branch:

8d7866e: 8356606: (fs) PosixFileAttributes.permissions() implementations should return an EnumSet
50dced8: 8356656: Drop unused DEVKIT_HOME from jib-profiles.js
e463895: 8356657: Use stable source-date for cmp-baseline jib profiles
... and 53 more: https://git.openjdk.org/jdk/compare/c6ffacb5754642083f614a5ee6dc76b7d145c605...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-05-12T16:49:52Z

@dfuch Pushed as commit 45dfc2c.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8353642: Deprecate networking permission classes for removal

e9dc414

openjdk bot added the rfr Pull request is ready for review label Apr 11, 2025

openjdk bot added security security-dev@openjdk.org nio nio-dev@openjdk.org net net-dev@openjdk.org labels Apr 11, 2025

openjdk bot added the csr Pull request needs approved CSR before integration label Apr 11, 2025

Missing white spaces

9b371b3

djelinski reviewed Apr 11, 2025

View reviewed changes

Michael-Mc-Mahon reviewed Apr 11, 2025

View reviewed changes

Review feedback. Deprecate getPermission for removal.

d47a31d

dfuch changed the title ~~8353642: Deprecate networking permission classes for removal~~ 8353642: Deprecate URL::getPermission method and networking permission classes for removal Apr 11, 2025

Michael-Mc-Mahon approved these changes Apr 11, 2025

View reviewed changes

djelinski approved these changes Apr 11, 2025

View reviewed changes

dfuch added 2 commits May 8, 2025 16:44

Revert changes to SocketPermission and CodeSource

2efe775

Merge branch 'master' into deprecate-net-perms-8353642

2807f3f

djelinski approved these changes May 8, 2025

View reviewed changes

irisclark approved these changes May 8, 2025

View reviewed changes

seanjmullan reviewed May 9, 2025

View reviewed changes

openjdk bot added ready Pull request is ready to be integrated and removed csr Pull request needs approved CSR before integration labels May 9, 2025

seanjmullan approved these changes May 12, 2025

View reviewed changes

openjdk bot added the integrated Pull request has been integrated label May 12, 2025

openjdk bot closed this May 12, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 12, 2025

Uh oh!

8353642: Deprecate URL::getPermission method and networking permission classes for removal #24592

8353642: Deprecate URL::getPermission method and networking permission classes for removal #24592

Uh oh!

Conversation

dfuch commented Apr 11, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Apr 11, 2025

Uh oh!

openjdk bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Apr 11, 2025

Uh oh!

mlbridge bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

dfuch commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djelinski commented Apr 11, 2025

Uh oh!

dfuch commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch commented Apr 11, 2025

Uh oh!

Michael-Mc-Mahon left a comment

Choose a reason for hiding this comment

Uh oh!

djelinski left a comment

Choose a reason for hiding this comment

Uh oh!

dfuch commented May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch commented Apr 11, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Apr 11, 2025 •

edited

Loading

mlbridge bot commented Apr 11, 2025 •

edited

Loading

dfuch commented Apr 11, 2025 •

edited

Loading

dfuch Apr 11, 2025 •

edited

Loading

dfuch commented Apr 11, 2025 •

edited

Loading

dfuch Apr 11, 2025 •

edited

Loading

dfuch commented May 8, 2025 •

edited

Loading