Re: RFR: 8319332: Security properties files inclusion [v20]

2024-09-23 Thread duke
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-09-23 Thread Sean Mullan
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-09-23 Thread Weijun Wang
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-09-22 Thread Martin Balao
On Thu, 5 Sep 2024 20:20:28 GMT, Sean Mullan wrote: >> I don't like the silent mode. If no one uses that key name, then everything >> is fine anyway. Otherwise, if someone really sets it, it's very likely they >> will want to read it somewhere and expect a non `null` value. >> >> Can we just s

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-09-16 Thread Martin Balao
On Thu, 5 Sep 2024 20:20:28 GMT, Sean Mullan wrote: >> I don't like the silent mode. If no one uses that key name, then everything >> is fine anyway. Otherwise, if someone really sets it, it's very likely they >> will want to read it somewhere and expect a non `null` value. >> >> Can we just s

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-09-16 Thread Weijun Wang
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-09-16 Thread Martin Balao
On Fri, 16 Aug 2024 16:13:17 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Code review and additional changes >> >> Throw an IllegalArgumentException exception if Security.get

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-09-05 Thread Martin Balao
On Thu, 5 Sep 2024 20:20:28 GMT, Sean Mullan wrote: >> I don't like the silent mode. If no one uses that key name, then everything >> is fine anyway. Otherwise, if someone really sets it, it's very likely they >> will want to read it somewhere and expect a non `null` value. >> >> Can we just s

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-09-05 Thread Sean Mullan
On Fri, 16 Aug 2024 16:13:17 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Code review and additional changes >> >> Throw an IllegalArgumentException exception if Security.get

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-09-04 Thread Martin Balao
On Mon, 26 Aug 2024 18:53:58 GMT, Sean Mullan wrote: >> I think throwing IAE is the cleanest approach and less likely there may be >> unexpected behavior if we are not worried about backporting. It would break >> any app previously using this as a property, but at least the behavior would >> b

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-08-26 Thread Martin Balao
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-08-26 Thread Sean Mullan
On Mon, 26 Aug 2024 14:40:46 GMT, Sean Mullan wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Document list of reserved keys in >> java.security.Security::getProperty/setProperty APIs. >> >> Co

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-08-26 Thread Martin Balao
On Mon, 26 Aug 2024 14:40:46 GMT, Sean Mullan wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Document list of reserved keys in >> java.security.Security::getProperty/setProperty APIs. >> >> Co

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-08-26 Thread Sean Mullan
On Wed, 21 Aug 2024 17:50:26 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v20]

2024-08-21 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-16 Thread Martin Balao
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-16 Thread Weijun Wang
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-16 Thread Martin Balao
On Thu, 15 Aug 2024 17:15:33 GMT, Sean Mullan wrote: > > We've not made a decision in regards to proposing this enhancement to old > > releases. With that said, I wouldn't consider anything older than 21u. If > > necessary, we can make backport-specific adjustments to the CSR and be more > > c

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-15 Thread Sean Mullan
On Mon, 12 Aug 2024 21:20:18 GMT, Martin Balao wrote: > We've not made a decision in regards to proposing this enhancement to old > releases. With that said, I wouldn't consider anything older than 21u. If > necessary, we can make backport-specific adjustments to the CSR and be more > conserva

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-12 Thread Martin Balao
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-11 Thread Weijun Wang
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-09 Thread Martin Balao
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-09 Thread Weijun Wang
On Wed, 7 Aug 2024 20:09:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 21:41:50 GMT, Weijun Wang wrote: >> Done in 580d34a63b5d3b6c7d2323413f338527db2d9acd. > > Thanks. You might need to update the CSR to include this in the spec change. Yes, I updated the user guide and the CSR to reflect this behavior. - PR Review Comment: https:/

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-07 Thread Weijun Wang
On Wed, 7 Aug 2024 20:05:45 GMT, Francisco Ferrari Bihurriet wrote: >> Yes, we can do that. > > Done in 580d34a63b5d3b6c7d2323413f338527db2d9acd. Thanks. You might need to update the CSR to include this in the spec change. - PR Review Comment: https://git.openjdk.org/jdk/pull/1648

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Weijun Wang
On Wed, 7 Aug 2024 20:10:39 GMT, Francisco Ferrari Bihurriet wrote: >> src/java.base/share/classes/java/security/Security.java line 118: >> >>> 116: } >>> 117: >>> 118: private static void loadMaster() { >> >> Maybe you can rename to `loadMain`. There have been some voices aga

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Francisco Ferrari Bihurriet
On Wed, 7 Aug 2024 17:47:42 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Throw an IllegalArgumentException exception if >> Security.setProperty("include", ...) is invoked. >>

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Francisco Ferrari Bihurriet
On Wed, 7 Aug 2024 19:13:32 GMT, Martin Balao wrote: >> src/java.base/share/classes/java/security/Security.java line 211: >> >>> 209: } >>> 210: >>> 211: private static void reset(LoadingMode mode) { >> >> The method here looks like there is a chance that `props` does not get

Re: RFR: 8319332: Security properties files inclusion [v19]

2024-08-07 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-07 Thread Francisco Ferrari Bihurriet
On Wed, 7 Aug 2024 18:20:15 GMT, Martin Balao wrote: >> I like this. >> >> Just wondering, shall we throw IAE if `getProperty("include")` is called as >> well? In a very rare case that someone is already using it in >> `java.security` file and the value happens to be an existing file name, the

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 18:01:19 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Throw an IllegalArgumentException exception if >> Security.setProperty("include", ...) is invoked. >>

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 17:52:10 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Throw an IllegalArgumentException exception if >> Security.setProperty("include", ...) is invoked. >>

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 18:40:53 GMT, Weijun Wang wrote: >> Yes, that's intended. Files obtained from a URL have no issues with having >> absolute-path includes. The only restriction for them is not to have >> relative includes, as there isn't a file path base to resolve it. > > So you deploy some p

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Weijun Wang
On Wed, 7 Aug 2024 18:21:41 GMT, Martin Balao wrote: >> src/java.base/share/classes/java/security/Security.java line 241: >> >>> 239: try { >>> 240: Path path = Path.of(expPropFile); >>> 241: if (!path.isAbsolute()) { >> >> So you allow a properties f

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 17:58:46 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Throw an IllegalArgumentException exception if >> Security.setProperty("include", ...) is invoked. >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 16:06:03 GMT, Weijun Wang wrote: >> Proposed a change here: >> https://github.com/openjdk/jdk/pull/16483/commits/530bd81c2a73a39f00c6ba9524752f30600cd04d > > I like this. > > Just wondering, shall we throw IAE if `getProperty("include")` is called as > well? In a very rare c

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Martin Balao
On Wed, 7 Aug 2024 17:44:44 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Throw an IllegalArgumentException exception if >> Security.setProperty("include", ...) is invoked. >>

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-07 Thread Weijun Wang
On Tue, 6 Aug 2024 23:55:06 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-07 Thread Weijun Wang
On Tue, 6 Aug 2024 23:52:04 GMT, Martin Balao wrote: >> May be. This is a public API that only documents `SecurityException` for >> cases in which there is a Security Manager and `NullPointerException` for >> cases in which either the key or the value are `null`. Wouldn't be the exact >> case

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-06 Thread Martin Balao
On Tue, 6 Aug 2024 23:19:08 GMT, Martin Balao wrote: >> src/java.base/share/classes/java/security/Security.java line 901: >> >>> 899: if (SecPropLoader.isInclude(key)) { >>> 900: return; >>> 901: } >> >> Don't you want to throw an exception here? > > May be. This is

Re: RFR: 8319332: Security properties files inclusion [v18]

2024-08-06 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-06 Thread Martin Balao
On Tue, 6 Aug 2024 21:02:50 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> two additional commits since the last revision: >> >> - Ensure Security::setProperty() cannot issue an include >> >>Co-authored-by: Martin Balao >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-08-06 Thread Weijun Wang
On Thu, 11 Jul 2024 19:41:56 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-07-11 Thread Francisco Ferrari Bihurriet
On Thu, 11 Jul 2024 19:41:56 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v17]

2024-07-11 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v16]

2024-07-05 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v15]

2024-07-05 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Sean Mullan
On Fri, 3 May 2024 20:46:46 GMT, Martin Balao wrote: >> src/java.base/share/conf/security/java.security line 70: >> >>> 68: # an error is thrown and explicit profile selection is required. In >>> order >>> 69: # to override properties defined in this file, the include statement >>> may be >>>

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Martin Balao
On Fri, 3 May 2024 20:02:29 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Profiles documentation adjustments. >> >> Co-authored-by: Francisco Ferrari >> Co-authored-by: Mar

Re: RFR: 8319332: Security properties files inclusion [v14]

2024-05-03 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Martin Balao
On Fri, 3 May 2024 19:37:02 GMT, Sean Mullan wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Profiles documentation adjustments. >> >> Co-authored-by: Francisco Ferrari >> Co-authored-by: Mar

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Martin Balao
On Fri, 3 May 2024 19:32:56 GMT, Sean Mullan wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Profiles documentation adjustments. >> >> Co-authored-by: Francisco Ferrari >> Co-authored-by: Mar

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Weijun Wang
On Thu, 2 May 2024 21:24:19 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-03 Thread Sean Mullan
On Thu, 2 May 2024 21:24:19 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v12]

2024-05-02 Thread Martin Balao
On Thu, 2 May 2024 21:07:03 GMT, Weijun Wang wrote: > The revised text is much clearer. For the last sentence, I would suggest > rephrasing "In order to prevent profile properties from being overridden" to > "In order to override properties defined in the main file". Isn't that your > real pur

Re: RFR: 8319332: Security properties files inclusion [v13]

2024-05-02 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v12]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 20:34:22 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v11]

2024-05-02 Thread Martin Balao
On Thu, 2 May 2024 19:07:50 GMT, Weijun Wang wrote: >> src/java.base/share/conf/security/java.security line 69: >> >>> 67: # statement will override any matching property defined in a profile. >>> In order >>> 68: # to avoid this behavior, the include statement may be placed at the >>> end of

Re: RFR: 8319332: Security properties files inclusion [v12]

2024-05-02 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v11]

2024-05-02 Thread Martin Balao
On Thu, 2 May 2024 19:09:07 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Profiles documentation adjustments. >> >> Co-authored-by: Francisco Ferrari >> Co-authored-by: Mar

Re: RFR: 8319332: Security properties files inclusion [v11]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 19:06:00 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request incrementally with >> one additional commit since the last revision: >> >> Profiles documentation adjustments. >> >> Co-authored-by: Francisco Ferrari >> Co-authored-by: Mar

Re: RFR: 8319332: Security properties files inclusion [v11]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 16:45:09 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Francisco Ferrari Bihurriet
On Thu, 2 May 2024 15:57:36 GMT, Weijun Wang wrote: > Another comment: now that the backward compatibility code is added, is it > still necessary to update the `DynStatic.java` test? @wangweij: it's no longer strictly necessary. However, we decided to leave it that way in order to lead by exam

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Martin Balao
On Thu, 2 May 2024 14:59:54 GMT, Weijun Wang wrote: > In the new `java.security` text, you have "the file profile.security must > exist". This is not necessary, right? I think what you meant to say is that > "if the system property is not defined, then it will be expanded to an empty > string

Re: RFR: 8319332: Security properties files inclusion [v11]

2024-05-02 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 14:07:13 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 14:07:13 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Weijun Wang
On Thu, 2 May 2024 14:07:13 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v10]

2024-05-02 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Weijun Wang
On Tue, 23 Apr 2024 17:19:55 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-05-01 Thread Martin Balao
On Fri, 19 Apr 2024 13:02:03 GMT, Francisco Ferrari Bihurriet wrote: >>> In the compatibility risk description of the CSR: >>> >>> > In line with the efforts to check invalid URLs (see >>> > [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL >>> > public constructors),

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Weijun Wang
On Tue, 23 Apr 2024 17:19:55 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Martin Balao
On Wed, 1 May 2024 18:34:41 GMT, Weijun Wang wrote: > I'm seeing > > ``` > java.lang.reflect.InvocationTargetException > at > java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:118) > at java.base/java.lang.reflect.Method.invoke(Method.j

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Weijun Wang
On Tue, 23 Apr 2024 17:19:55 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Martin Balao
On Wed, 1 May 2024 15:12:10 GMT, Weijun Wang wrote: > Just one more question on the system property expansion when it's not > defined. In your example: > > > include ${java.home}/conf/security/profile${SecurityProfile}.security > > How bad will it be if we require user to set `SecurityProfile`

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Weijun Wang
On Tue, 23 Apr 2024 17:19:55 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-05-01 Thread Weijun Wang
On Tue, 23 Apr 2024 17:19:55 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v9]

2024-04-23 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v8]

2024-04-22 Thread Weijun Wang
On Mon, 22 Apr 2024 20:42:44 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-22 Thread Martin Balao
On Fri, 19 Apr 2024 19:40:53 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v8]

2024-04-22 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Fri, 19 Apr 2024 19:40:53 GMT, Weijun Wang wrote: > Yes, I can see its effect on the relative include. Maybe use the deprecated > URL constructor as a fallback when the other mechanisms fail? Yes, that's what we have in mind. We will try to handle it as a local path and when not possible, w

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Fri, 19 Apr 2024 13:19:44 GMT, Weijun Wang wrote: > > > > Is it worth breaking such invalid URLs? > > I'm just not sure about the compatibility impact. The example > "file:///C:\some\path\extra.properties" you gave looks quite innocent and > could be generated by a casual script. > > Can t

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 13:31:42 GMT, Francisco Ferrari Bihurriet wrote: >> Oh, I meant the final `else`. What does it mean if a file is neither >> "regular" nor "directory"? Also I don't quite understand why one uses >> `toRealPath` and one uses `toAbsolutePath`. Is this related to resolving a >

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Fri, 19 Apr 2024 13:02:27 GMT, Weijun Wang wrote: >> Hi @wangweij, to complement @martinuy's answer, the following commands can >> trigger this error message in the different described contexts: >> >> java -Djava.security.properties=file:///etc >> -XshowSettings:security:properties -Djava.s

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 13:02:03 GMT, Francisco Ferrari Bihurriet wrote: > > > Is it worth breaking such invalid URLs? I'm just not sure about the compatibility impact. The example "file:///C:\some\path\extra.properties" you gave looks quite innocent and could be generated by a casual script. Ca

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Fri, 19 Apr 2024 08:16:34 GMT, Martin Balao wrote: >> In the compatibility risk description of the CSR: >>> In line with the efforts to check invalid URLs (see >>> [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL >>> public constructors), "java.security.properties" f

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Weijun Wang
On Fri, 19 Apr 2024 12:58:32 GMT, Francisco Ferrari Bihurriet wrote: >> src/java.base/share/classes/java/security/Security.java line 256: >> >>> 254: } else if (Files.isDirectory(path)) { >>> 255: throw new IOException("Is a directory"); >>> 256: } else {

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Francisco Ferrari Bihurriet
On Wed, 17 Apr 2024 14:30:02 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:55:05 GMT, Weijun Wang wrote: > In the compatibility risk description of the CSR: > > > In line with the efforts to check invalid URLs (see > > [JDK-8294241](https://bugs.openjdk.org/browse/JDK-8294241): Deprecate URL > > public constructors), "java.security.properties"

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:30:02 GMT, Weijun Wang wrote: >> Francisco Ferrari Bihurriet has updated the pull request with a new target >> base due to a merge or a rebase. The pull request now contains 11 commits: >> >> - Merge 'openjdk/master' into JDK-8319332 >> - Merge 'openjdk/master' into JDK

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-19 Thread Martin Balao
On Wed, 17 Apr 2024 14:28:58 GMT, Weijun Wang wrote: > "If a system property does not have a value, it expands to the empty string." > What's the benefit? It will be nice if you can include an example on the CSR. Expanding to the empty string has the advantage that we can parameterize part of

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-17 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-04-17 Thread Weijun Wang
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-03-06 Thread Francisco Ferrari Bihurriet
On Wed, 6 Mar 2024 12:19:14 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v7]

2024-03-06 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v6]

2024-03-04 Thread Francisco Ferrari Bihurriet
> The implementation of this proposal is based on the requirements, > specification and design choices described in the [JDK-8319332] ticket and > its respective CSR [JDK-8319333]. What follows are implementation notes > organized per functional component, with the purpose of assisting to naviga

Re: RFR: 8319332: Security properties files inclusion [v5]

2024-03-04 Thread Francisco Ferrari Bihurriet
On Mon, 8 Jan 2024 18:59:54 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

Re: RFR: 8319332: Security properties files inclusion [v5]

2024-01-08 Thread Francisco Ferrari Bihurriet
On Mon, 8 Jan 2024 18:59:54 GMT, Francisco Ferrari Bihurriet wrote: >> The implementation of this proposal is based on the requirements, >> specification and design choices described in the [JDK-8319332] ticket and >> its respective CSR [JDK-8319333]. What follows are implementation notes >>

  1   2   >