RFR: 8312630: java/security should not create unmodifiable collections with redundant wrapping [v2]

John Jiang jjiang at openjdk.org
Wed Jul 26 23:38:49 UTC 2023


On Wed, 26 Jul 2023 16:52:20 GMT, Sean Mullan <mullan at openjdk.org> wrote:

> The latter part is true (prevented from subsequent modification) but, unless I am mistaken, the former (making a clone/copy) is not. For example, before your change, this assert would pass:
> 
> ```
> Map m = Collections.unmodifiableMap(map);
> DomainLoadStoreParameters params = new DomainLoadStoreParameters(uri, m);
> assert m != params.getProtectionParams();
> ```
> 
> After your change, I think it fails (can you check?). Even though the protection in both cases should be adequate, it is a subtle behavior change that I don't think the current specification covers.

I get the point now.

> As mentioned, I don't think this change is critical unless you have a stronger case.

I'll withdraw this PR.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/15008#discussion_r1275577482


More information about the security-dev mailing list