RFR: 8359808: JavaRuntimeURLConnection should only connect to non-directory resources [v2]

[David Beaumont]

On Wed, 18 Jun 2025 13:54:42 GMT, David Beaumont <duke at openjdk.org> wrote:

>>> Happy to accept rewording here. I do want to pull out that there _is_ a conceptual reason for treating module names like domain authorities though, or just make the code treat the whole path the same. Having unexplained weirdness like this just ends up being a drain on future maintainers otherwise.
>> 
>> I don't disagree on the weirdness but I don't want to mislead readers that this has anything to do with the URL authority component (the jrt scheme does not have this component).  However to explain the weirdness requires digging into history, probably the jake repo where the changes for JEP 220 were accumulated before the JEP was integrated.
>
> The alternative is to permit module names to use percent encoding, since package names (and thus module names) can include non-ASCII characters, and doing so would simplify the code, but it also allows a level of obfuscateability to the URLs which we might not desire (unless we reject any over-encoding of ASCII).

I updated the comment and some TODOs. I'll likely raise a separate PR for it since I suspect we need to end up:
1. allowing percent encoding everywhere (to support non-ASCII Unicode).
2. disallowing over-encoding (e.g. of '/' or '$', or just any ASCII) to prevent obfuscation.
But as it's a behaviour change, I'd rather separate it out.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/25871#discussion_r2155083474