RFR: 8294241: Deprecate URL public constructors

Peter Firmstone peter.firmstone at zeus.net.au
Thu Oct 27 11:48:34 UTC 2022

I'm considering using one of the non parsing constructors, as Alan 
points out we're currently double parsing.  By the time the constructor 
is removed, I'm guessing there will be a RFC3986 URI implementation in 
the JDK, so we'll change to that when it happens.   Or if you decide to 
not deprecate one of the non parsing constructors, I'm good with that also.



On 27/10/2022 9:29 pm, Daniel Fuchs wrote:
> On 27/10/2022 07:26, Alan Bateman wrote:
>>> We have a strict URI 3986 implementation, which we use to create all 
>>> URL instances from.
> Note also that though this change proposes to deprecate these
> constructors in order to provide a stronger warning against their
> potential misuse, it does not deprecate them for removal.
> If you are confident in your parsing/validation you can of course
> still provide a `URL toURL(org.apache.river.api.net.URI)` method that
> calls a constructor, and annotate that one place with 
> `@SuppressWarnings("deprecation")`.
> best regards,
> -- dabniel

More information about the security-dev mailing list