On Thu, 3 Sep 2026 19:09:20 GMT, Sean Mullan <[email protected]> wrote:
>> src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/SecurityPropertiesPlugin.java
>> line 146:
>>
>>> 144: if (propValue != null) {
>>> 145: // override value
>>> 146: lines.add(propName + "=" + propValue);
>>
>> `propName` and `propValue` raw values are passed unescaped, this will work
>> for ISO-8859-1 characters, but will fail for Unicode characters greater than
>> `\u00FF`, backward slashes, spaces in keys, and idented or multi-line values.
>>
>> For example, if the file passed as `--security-properties` contains
>> properties with `\` or `\u20AC`, `extraProps` will have them parsed as `` or
>> `€`. When writing to the ISO-8859-1 byte array, the backward slash will be
>> stored as a single slash (which the `Properties` parser discards) and the
>> Euro sign as a question mark.
>>
>> Perhaps we can use [`Properties.store(OutputStream out, String
>> comments)`](https://docs.oracle.com/en/java/javase/26/docs/api/java.base/java/util/Properties.html#store(java.io.OutputStream,java.lang.String))
>> in a similar way as you did with `Properties.load()` (one property at a
>> time). It handles the escaping properly, the only caveat is it will require
>> removing the header date comment and a trailing newline:
>>
>>
>> jshell -<<'EOF'
>> Properties test = new Properties();
>> test.put("aaa", "euro_\u20AC_value");
>> test.put("abb", "slash_\_value");
>> test.put("euro_\u20AC_key", "111");
>> test.put("slash_\_key", "222");
>> test.put("spaced key", "333");
>> test.put("zyy", " indented value");
>> test.put("zzz", "multi-line\nvalue");
>> test.list(System.out);
>>
>> System.out.println("-- showing Properties.store() result --")
>> ByteArrayOutputStream bao = new ByteArrayOutputStream();
>> test.store(bao, null);
>> System.out.println(bao.toString(StandardCharsets.ISO_8859_1));
>> EOF
>>
>>
>> Output:
>>
>>
>> -- listing properties --
>> aaa=euro_€_value
>> abb=slash__value
>> euro_€_key=111
>> slash__key=222
>> spaced key=333
>> zyy= indented value
>> zzz=multi-line
>> value
>> -- showing Properties.store() result --
>> #Thu Sep 03 16:07:22 CEST 2026
>> aaa=euro_\u20AC_value
>> abb=slash_\_value
>> euro_\u20AC_key=111
>> slash_\_key=222
>> spaced\ key=333
>> zyy=\ indented value
>> zzz=multi-line\nvalue
>>
>>
>>
>> The core escaping logic is in
>> [`Properties.saveConvert()`](https://github.com/openjdk/jdk/blob/e9222ab58987711adafd598a01b7ad58ab25f895/src/java.base/share/classes/java/util/Properties.java#L682-L738).
>> For the [JDK-8319332: Security properties files inclus...
>
> Oh the joy of character encodings :)
>
> Yes, this is absolutely a valid issue. Let me experiment a bit with
> `Properties.store` to see if I can make it work - otherwise that looks like a
> smaller piece of code that is more manageable as a copy/paste for now.
I think it would be useful to add a helper method to take a key and value and
return the line for the properties file, then use it in the (currently 3)
places that adds to lines. That will centralize the escape handling in one
place.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/31884#discussion_r3935536555
