RFR: 8321053: Use ByteArrayInputStream.buf directly when parameter of transferTo() is trusted [v2]
Brian Burkhalter
bpb at openjdk.org
Thu Nov 30 23:30:25 UTC 2023
On Thu, 30 Nov 2023 12:34:24 GMT, Sergey Tsypanov <stsypanov at openjdk.org> wrote:
>> Brian Burkhalter has updated the pull request incrementally with one additional commit since the last revision:
>>
>> 8321053: Trust non-FilterOutputStreams in "java." packages
>
> src/java.base/share/classes/java/io/ByteArrayInputStream.java line 211:
>
>> 209: if (len > 0) {
>> 210: byte[] tmp;
>> 211: if ("java.io".equals(out.getClass().getPackageName()))
>
> I think we should trust all classes in `java.*` packages, i.e. the check should be
>
> out.getClass().getPackageName().startsWith("java.")
Change in 176d5165f7d8f3fa4814c9838abb5d18d9f3c338 to use `java.` instead of `java.io`.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/16893#discussion_r1411408644
More information about the core-libs-dev
mailing list