RFR: 8295803: Console should be usable in jshell and other environments [v7]
Jaikiran Pai
jpai at openjdk.org
Tue Dec 6 07:02:17 UTC 2022
On Mon, 5 Dec 2022 19:52:59 GMT, Naoto Sato <naoto at openjdk.org> wrote:
>> This is to allow Console to be used even when it is not attached to the platform provided terminal, such as the case when the standard input is redirected. `System.console()` now returns a Console implementation based on `jdk.internal.le` terminal by default, or jshell implementation if available. A corresponding CSR has been drafted.
>
> Naoto Sato has updated the pull request incrementally with one additional commit since the last revision:
>
> Fixed the copyright year
src/java.base/share/classes/java/io/Console.java line 615:
> 613: var consModName = System.getProperty("jdk.console",
> 614: JdkConsoleProvider.DEFAULT_PROVIDER_MODULE_NAME);
> 615: return ServiceLoader.load(JdkConsoleProvider.class).stream()
Are we intentionally using thread context classloader (which can be different depending on which caller ends up first accessing/initializing the `java.io.Console` class) to load these services?
I initially thought that `java.io.Console` might be used/initialized early in the bootstrap process of Java so the classloader could perhaps be deterministic, but running a trivial Java application with `-verbose:class` shows that `java.io.Console` doesn't get instantiated during the launch, so that leaves this code to "first access wins" situation and maybe an "incorrect" context classloader which doesn't have access the configured `jdk.console` module may end up causing this code to default to `java.io.Console`?
public class Hello {
public static void main(final String[] args) {
}
}
java -verbose:class Hello.java
Instead, should we perhaps use the ModuleLayer to find this configured module and then use its classloader to load the `JdkConsoleProvider` service provider? Something like:
final Optional<Module> mod = ModuleLayer.boot().findModule(consModName);
// ... if not present default to java.io.Console else use the module's classloader to try and load the JdkConsoleProvider
return ServiceLoader.load(JdkConsoleProvider.class, mod.get().getClassLoader()).stream()......
-------------
PR: https://git.openjdk.org/jdk/pull/11421
More information about the security-dev
mailing list