API REVIEW: RT-23888, Make PopupFeatures and PromptData final

[Randahl Fink Isaksen]

Richard, I agree that obvious cases like java.lang.String have to be final to avoid security related issues. But how can that be a defence for the final classes found in JavaFX, like Text and WebView?

Currently, I can extend PasswordField if I want to create a security breach which sends the user's password off to a remote server in Thailand, but I cannot extend Text to create a banner component which automatically makes the Text fill color flash, or extended WebView to add more innovative features. Where is the sense in that?

Whenever you make a non-value class final you prevent third party framework developers from adding more innovative features. You take the "open" out of open source. It is just wrong.

With all due respect

Randahl





On Aug 31, 2012, at 15:45 , Richard Bair <richard.bair at oracle.com> wrote:

> Security for one. You can do evil things to non final classes! That is just a general rule (which is why generally we want to make everything final we can). In this particular case it may not matter.
> 
> Richard
> 
> On Aug 31, 2012, at 6:03 AM, Tom Eugelink wrote:
> 
>> All I can say is that I hate final classes. "Not meant" does not mean "no one ever wants to".
>> 
>> What is the gain of making them final and what is the loss of not making them final?
>> 
>> Tom
>> 
>> 
>> 
>> On 2012-08-31 14:59, Peter Zhelezniakov wrote:
>>> Hello,
>>> 
>>> There are two helper classes in javafx.scene.web package: PopupFeatures
>>> and PromptData. They are not meant to be extended by developers, so I
>>> hereby propose making them final, i.e.:
>>> 
>>> public final class PopupFeatures {
>>>    public final boolean hasMenu();
>>>    public final boolean hasStatus();
>>>    public final boolean hasToolbar();
>>>    public final boolean isResizable();
>>> }
>>> 
>>> public final class PromptData {
>>>    public PromptData(String message, String defaultValue);
>>>    public final String getMessage();
>>>    public final String getDefaultValue();
>>> }
>>> 
>>> Thanks!
>> 
>