Skip to content

Commit d714b5d

Browse files
seanjmullanseanjmullan
committed
8356557: Update CodeSource::implies API documentation and deprecate java.net.SocketPermission class for removal
Reviewed-by: jpai
1 parent ce02836 commit d714b5d

3 files changed

Lines changed: 59 additions & 8 deletions

File tree

‎src/java.base/share/classes/java/net/SocketPermission.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,13 @@
111111
* <P>
112112
* The actions string is converted to lowercase before processing.
113113
*
114-
* @apiNote
114+
* @deprecated
115115
* This permission cannot be used for controlling access to resources
116116
* as the Security Manager is no longer supported.
117117
*
118118
* @spec https://www.rfc-editor.org/info/rfc2732
119119
* RFC 2732: Format for Literal IPv6 Addresses in URL's
120120
* @see java.security.Permissions
121-
* @see SocketPermission
122121
*
123122
*
124123
* @author Marianne Mueller
@@ -128,6 +127,7 @@
128127
* @serial exclude
129128
*/
130129

130+
@Deprecated(since = "26", forRemoval = true)
131131
public final class SocketPermission extends Permission
132132
implements java.io.Serializable
133133
{
@@ -1307,6 +1307,7 @@ public static void main(String args[]) throws Exception {
13071307
* @serial include
13081308
*/
13091309

1310+
@SuppressWarnings("removal")
13101311
final class SocketPermissionCollection extends PermissionCollection
13111312
implements Serializable
13121313
{

‎src/java.base/share/classes/java/security/CodeSource.java‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -73,6 +73,7 @@ public class CodeSource implements java.io.Serializable {
7373
private transient java.security.cert.Certificate[] certs = null;
7474

7575
// cached SocketPermission used for matchLocation
76+
@SuppressWarnings("removal")
7677
private transient SocketPermission sp;
7778

7879
// for generating cert paths
@@ -269,9 +270,22 @@ public final CodeSigner[] getCodeSigners() {
269270
* equal to <i>codesource</i>'s protocol, ignoring case.
270271
*
271272
* <li> If this object's host (getLocation().getHost()) is not null,
272-
* then the SocketPermission
273-
* constructed with this object's host must imply the
274-
* SocketPermission constructed with <i>codesource</i>'s host.
273+
* then the following checks are made in order:
274+
* <ul>
275+
* <li> If this object's host was initialized with a single IP
276+
* address then one of <i>codesource</i>'s IP addresses must be
277+
* equal to this object's IP address.
278+
* <li> If this object's host is a wildcard domain (such as
279+
* *.example.com), then <i>codesource</i>'s canonical host name
280+
* (the name without any preceding *) must end with this object's
281+
* canonical host name. For example, *.example.com implies
282+
* *.foo.example.com.
283+
* <li> If this object's host was not initialized with a single
284+
* IP address, then one of this object's IP addresses must equal
285+
* one of <i>codesource</i>'s IP addresses or this object's
286+
* canonical host name must equal <i>codesource</i>'s canonical
287+
* host name.
288+
* </ul>
275289
*
276290
* <li> If this object's port (getLocation().getPort()) is not
277291
* equal to -1 (that is, if a port is specified), it must equal
@@ -387,6 +401,7 @@ boolean matchCerts(CodeSource that, boolean strict)
387401
*
388402
* @param that {@code CodeSource} to compare against
389403
*/
404+
@SuppressWarnings("removal")
390405
private boolean matchLocation(CodeSource that) {
391406
if (location == null)
392407
return true;

‎test/jdk/java/security/CodeSource/Implies.java‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,11 +23,12 @@
2323

2424
/*
2525
* @test
26-
* @bug 4866847 7152564 7155693
26+
* @bug 4866847 7152564 7155693 8356557
2727
* @summary various CodeSource.implies tests
2828
*/
2929

3030
import java.security.CodeSource;
31+
import java.net.InetAddress;
3132
import java.net.URL;
3233

3334
public class Implies {
@@ -48,6 +49,40 @@ public static void main(String[] args) throws Exception {
4849
// port check should match default port of thatURL
4950
testImplies(thisURL, thatURL, true);
5051

52+
thisURL = new URL("http", "204.160.241.0", "file");
53+
thatURL = new URL("http", "localhost", "file");
54+
// ip address should not imply localhost's IP address
55+
testImplies(thisURL, thatURL, false);
56+
57+
thisURL = new URL("http", "204.160.241.0", "file");
58+
thatURL = new URL("http", "*.example.com", "file");
59+
// ip address should not imply wildcarded host
60+
testImplies(thisURL, thatURL, false);
61+
62+
InetAddress ia = InetAddress.getLocalHost();
63+
thisURL = new URL("http", ia.getHostAddress(), "file");
64+
thatURL = new URL("http", ia.getHostName(), "file");
65+
// ip address should imply host name with same ip address
66+
testImplies(thisURL, thatURL, true);
67+
68+
thisURL = new URL("http", "*.example.com", "file");
69+
thatURL = new URL("http", "*.foo.example.com", "file");
70+
// wildcarded host name should imply wildcarded host name ending with
71+
// same canonical host name
72+
testImplies(thisURL, thatURL, true);
73+
74+
thisURL = new URL("http", "example.com", "file");
75+
thatURL = new URL("http", "*.foo.example.com", "file");
76+
// host name should not imply wildcarded host name ending with same
77+
// canonical host name
78+
testImplies(thisURL, thatURL, false);
79+
80+
thisURL = new URL("http", "*.example.com", "file");
81+
thatURL = new URL("http", "foo.example.com", "file");
82+
// wildcarded host name should imply host name ending with same
83+
// canonical host name
84+
testImplies(thisURL, thatURL, true);
85+
5186
System.out.println("test passed");
5287
}
5388

0 commit comments

Comments
 (0)