RFR: 8356557: Update CodeSource::implies API documentation and deprecate java.net.SocketPermission class for removal [v2]

Jaikiran Pai jpai at openjdk.org
Thu Jul 17 12:46:53 UTC 2025


On Mon, 14 Jul 2025 20:04:21 GMT, Sean Mullan <mullan at openjdk.org> wrote:

>> `SocketPermission` should be deprecated for removal as has already been done for many other `Permission` subclasses. However, `CodeSource.implies()` has specification dependencies on `SocketPermission` which requires additional changes to decouple those dependencies. 
>> 
>> This change deprecates `SocketPermission`for removal and removes the dependency on `SocketPermission` from `CodeSource.implies` by copying the relevant conditions from `SocketPermission.implies`. Additional test cases for `CodeSource.implies` were also added to check that the behavior is consistent.
>> 
>> Note that we may also eventually deprecate `CodeSource.implies` for removal but that requires more investigation.
>
> Sean Mullan has updated the pull request incrementally with one additional commit since the last revision:
> 
>   Add @SuppressWarnings("removal") to SocketPermissionCollection.

On a related note, I did a brief search for SocketPermission usages in the JDK and while doing so, I noticed that there's a `sun.security.util.SecurityConstants` class which has a lot of leftover unused security permission related constants. Maybe that can be cleaned up as a separate task?

-------------

PR Comment: https://git.openjdk.org/jdk/pull/26300#issuecomment-3083933894


More information about the security-dev mailing list