RFR: 8344221: Remove calls to SecurityManager and and doPrivileged in java.net.IDN, java.net.URL, java.net.URLConnection, sun.net.util.URLUtil, and java.net.URLStreamHandlerProvider after JEP 486 integration [v2]

[Roger Riggs]

On Fri, 15 Nov 2024 19:45:04 GMT, Daniel Fuchs <dfuchs at openjdk.org> wrote:

>> src/java.base/share/classes/java/net/URLConnection.java line 1406:
>> 
>>> 1404:                 f = iterator.next();
>>> 1405:             } catch (ServiceConfigurationError e) {
>>> 1406:                 if (e.getCause() instanceof SecurityException) {
>> 
>> I assume the try-catch can be removed as SecurityException won't be thrown.
>
> Is that sure? We might have custom handlers there (ContentHandlerFactory is a public exported service interface) - some of them might be throwing `SecurityException` for reasons of their own. That's why I was conservatively keeping this code. Please let me know if you think I should just throw SCE now in that case.

A thrown SecurityException (from a provider) would be handled as any other RuntimeException.
It is not specified that Providers can throw SecurityException and expect it to be ignored.
It may be worth a release note, though.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/22153#discussion_r1844411048