archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 06:45:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8338411: Implement JEP 486: Permanently Disable the Security Manager

Browse source 
Co-authored-by: Sean Mullan <mullan@openjdk.org>
Co-authored-by: Alan Bateman <alanb@openjdk.org>
Co-authored-by: Weijun Wang <weijun@openjdk.org>
Co-authored-by: Aleksei Efimov <aefimov@openjdk.org>
Co-authored-by: Brian Burkhalter <bpb@openjdk.org>
Co-authored-by: Daniel Fuchs <dfuchs@openjdk.org>
Co-authored-by: Harshitha Onkar <honkar@openjdk.org>
Co-authored-by: Joe Wang <joehw@openjdk.org>
Co-authored-by: Jorn Vernee <jvernee@openjdk.org>
Co-authored-by: Justin Lu <jlu@openjdk.org>
Co-authored-by: Kevin Walls <kevinw@openjdk.org>
Co-authored-by: Lance Andersen <lancea@openjdk.org>
Co-authored-by: Naoto Sato <naoto@openjdk.org>
Co-authored-by: Roger Riggs <rriggs@openjdk.org>
Co-authored-by: Brent Christian <bchristi@openjdk.org>
Co-authored-by: Stuart Marks <smarks@openjdk.org>
Co-authored-by: Ian Graves <igraves@openjdk.org>
Co-authored-by: Phil Race <prr@openjdk.org>
Co-authored-by: Erik Gahlin <egahlin@openjdk.org>
Co-authored-by: Jaikiran Pai <jpai@openjdk.org>
Reviewed-by: kevinw, aivanov, rriggs, lancea, coffeys, dfuchs, ihse, erikj, cjplummer, coleenp, naoto, mchung, prr, weijun, joehw, azvegint, psadhukhan, bchristi, sundar, attila
This commit is contained in:
Sean Mullan 2024-11-12 17:16:15 +00:00
parent c12b386d19
commit db85090553
1885 changed files with 5528 additions and 65650 deletions
Download patch file Download diff file Expand all files Collapse all files

43
src/java.base/share/classes/java/io/ObjectOutputStream.java
View file

@ -237,16 +237,8 @@ public class ObjectOutputStream
* ensure that constructors for receiving ObjectInputStreams will not block
* when reading the header.
*
* <p>If a security manager is installed, this constructor will check for
* the "enableSubclassImplementation" SerializablePermission when invoked
* directly or indirectly by the constructor of a subclass which overrides
* the ObjectOutputStream.putFields or ObjectOutputStream.writeUnshared
* methods.
*
* @param out output stream to write to
* @throws IOException if an I/O error occurs while writing stream header
* @throws SecurityException if untrusted subclass illegally overrides
* security-sensitive methods
* @throws NullPointerException if {@code out} is {@code null}
* @since 1.4
* @see ObjectOutputStream#ObjectOutputStream()
@ -274,19 +266,9 @@ public class ObjectOutputStream
* ObjectOutputStream to not have to allocate private data just used by
* this implementation of ObjectOutputStream.
*
* <p>If there is a security manager installed, this method first calls the
* security manager's {@code checkPermission} method with a
* {@code SerializablePermission("enableSubclassImplementation")}
* permission to ensure it's ok to enable subclassing.
*
* @throws SecurityException if a security manager exists and its
* {@code checkPermission} method denies enabling
* subclassing.
* @throws IOException if an I/O error occurs while creating this stream
* @see SecurityManager#checkPermission
* @see java.io.SerializablePermission
*/
protected ObjectOutputStream() throws IOException, SecurityException {
protected ObjectOutputStream() throws IOException {
@SuppressWarnings("removal")
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
@ -414,12 +396,6 @@ public class ObjectOutputStream
* writeUnshared, and not to any transitively referenced sub-objects in the
* object graph to be serialized.
*
* <p>ObjectOutputStream subclasses which override this method can only be
* constructed in security contexts possessing the
* "enableSubclassImplementation" SerializablePermission; any attempt to
* instantiate such a subclass without this permission will cause a
* SecurityException to be thrown.
*
* @param obj object to write to stream
* @throws NotSerializableException if an object in the graph to be
* serialized does not implement the Serializable interface
@ -611,26 +587,11 @@ public class ObjectOutputStream
* enabled, the {@link #replaceObject} method is called for every object being
* serialized.
*
* <p>If object replacement is currently not enabled, and
* {@code enable} is true, and there is a security manager installed,
* this method first calls the security manager's
* {@code checkPermission} method with the
* {@code SerializablePermission("enableSubstitution")} permission to
* ensure that the caller is permitted to enable the stream to do replacement
* of objects written to the stream.
*
* @param enable true for enabling use of {@code replaceObject} for
* every object being serialized
* @return the previous setting before this method was invoked
* @throws SecurityException if a security manager exists and its
* {@code checkPermission} method denies enabling the stream
* to do replacement of objects written to the stream.
* @see SecurityManager#checkPermission
* @see java.io.SerializablePermission
*/
protected boolean enableReplaceObject(boolean enable)
throws SecurityException
{
protected boolean enableReplaceObject(boolean enable) {
if (enable == enableReplace) {
return enable;
}