RFR: 8281561: Disable http DIGEST mechanism with MD5 by default [v2]

[Michael McMahon]

On Wed, 9 Mar 2022 15:53:02 GMT, Daniel Fuchs <dfuchs at openjdk.org> wrote:

>> src/java.base/share/classes/sun/net/www/protocol/http/DigestAuthentication.java line 85:
>> 
>>> 83:                 public String run() {
>>> 84:                     return Security.getProperty(secPropName)
>>> 85:                                    .replaceAll("\\s", "")
>> 
>> `Security.getProperty` may return `null` so replacement should only be made after checking that it is non null.
>
> Maybe `String.trim()` should be called on each element after splitting instead: you want to remove spaces before and after commas, not necessarily spaces within a name. "MD 5, SHA-256" probably shouldn't be parsed as "MD5,SHA-256".

Okay.

-------------

PR: https://git.openjdk.java.net/jdk/pull/7688