RFR: 8268349: Provide more detail in JEP 411 warning messages

Alan Bateman alanb at openjdk.java.net
Tue Jun 8 06:16:13 UTC 2021


On Mon, 7 Jun 2021 20:42:53 GMT, Weijun Wang <weijun at openjdk.org> wrote:

> More loudly and precise warning messages when a security manager is either enabled at startup or installed at runtime.

Changes requested by alanb (Reviewer).

src/java.base/share/classes/java/lang/System.java line 331:

> 329: 
> 330:     // Remember original System.err. setSecurityManager() warning goes here
> 331:     private static PrintStream oldErrStream = null;

I assume this should needs to be volatile and @Stable. I think we need a better name for it too.

src/java.base/share/classes/java/lang/System.java line 336:

> 334:         // Remember callers of setSecurityManager() here so that warning
> 335:         // is only printed once for each different caller
> 336:         final static Map<String, Boolean> callersOfSSM = new WeakHashMap<>();

You can't use a WeakHashMap without synchronization but a big question here is whether a single caller frame is sufficient. If I were doing this then I think I would capture the hash of a number of stack frames to create a better filter.

src/java.base/share/classes/java/lang/System.java line 2219:

> 2217:                                 WARNING: java.lang.SecurityManager is deprecated and will be removed in a future release
> 2218:                                 WARNING: -Djava.security.manager=%s will have no effect when java.lang.SecurityManager is removed
> 2219:                                 """, smProp);

Raw strings may be useful here but means the lines length are inconsistent and makes it too hard to look at side by side diffs now.

-------------

PR: https://git.openjdk.java.net/jdk/pull/4400



More information about the security-dev mailing list