RFR: 8338445: jdk.internal.loader.URLClassPath may leak JarFile instance when dealing with unexpected Class-Path entry in manifest [v2]

[Alan Bateman]

On Tue, 27 Aug 2024 04:14:03 GMT, Jaikiran Pai <jpai at openjdk.org> wrote:

> The current specification of this attribute at https://docs.oracle.com/en/java/javase/21/docs/specs/jar/jar.html#class-path-attribute is very extensive and I think very clear (and that's a good thing). However, I think that page isn't visited very often or found easily. 

We significantly re-worded the Class-Path section a few releases back but the eco system continues to put file paths, photos of cats, and other problematic values into this attribute.

> The tutorial for creating manifest files and adding `Class-Path` entry, I think, is the more commonly visited one https://docs.oracle.com/javase/tutorial/deployment/jar/downman.html (at least that's the one I usually find in search results). I wonder if that tutorial page can be improved a bit or at least point to the specification page of the `Class-Path` attribute.

This page mentions applets so this is a very old tutorial. We may be able to get it cleaned up.

-------------

PR Comment: https://git.openjdk.org/jdk/pull/20691#issuecomment-2311761855