RFR: 8283340: Remove support for -Dsun.misc.URLClassPath.disableJarChecking

[Liam Miller-Cushon]

On Fri, 18 Mar 2022 08:39:46 GMT, Alan Bateman <alanb at openjdk.org> wrote:

> I don't know what the motivation for this change is but there is more to this story and I think will require agreement from the security area before removing it.

Thanks @AlanBateman. The motivation is that I was investigating an unrelated change to this code (a potential performance optimization), and it accidentally removed the logic that's catching and ignoring the `IOException`, and when I investigated this logic it looked unused and seemed like a cleanup opportunity. There don't seem to be any public tests for this feature.

If it's security related I understand there may be other internal tests, and this PR may be a non-starter. I'd be interested in anything you can share about the story here, but if this code needs to stay for security reasons feel free to close the PR.

Do you expect this will still be turned down once the `SecurityManager` remove is complete? Or does it make sense to think about generalize this logic so it works even if there isn't a `SecurityManager` enabled?

-------------

PR: https://git.openjdk.java.net/jdk/pull/7861