FULL PRODUCT VERSION :
java version "10-ea" 2018-03-20
Java(TM) SE Runtime Environment 18.3 (build 10-ea+42)
Java HotSpot(TM) 64-Bit Server VM 18.3 (build 10-ea+42, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]

A DESCRIPTION OF THE PROBLEM :
We try to scan a jar file for entries within a WebStart application and get the following exception although the JNLP file contains "<all-permissions />":

java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")

This comes from inside java.util.zip.ZipFile.


REGRESSION. Last worked in version 9.0.1

ADDITIONAL REGRESSION INFORMATION:
java version "9.0.1"
Java(TM) SE Runtime Environment (build 9.0.1+11)
Java HotSpot(TM) 64-Bit Server VM (build 9.0.1+11, mixed mode)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Build a WebStart application with the main class below. Add an empty file empty file called "message.properties" to the package "simplewebstart". Then start the WebStart application with Java 10.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The application should output two jar entries: "Main" and "message.properties".
ACTUAL -
An exception occurs.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")
at java.base/java.security.AccessControlContext.checkPermission(Unknown Source)
at java.base/java.security.AccessController.checkPermission(Unknown Source)
at java.base/java.lang.SecurityManager.checkPermission(Unknown Source)
at jdk.javaws@10-ea/com.sun.javaws.security.JavaWebStartSecurity.checkPermission(Unknown Source)
at java.base/java.lang.Class.checkMemberAccess(Unknown Source)
at java.base/java.lang.Class.getDeclaredMethod(Unknown Source)
at java.base/java.util.zip.ZipFile$CleanableResource.get(Unknown Source)
at java.base/java.util.zip.ZipFile.<init>(Unknown Source)
at java.base/java.util.zip.ZipFile.<init>(Unknown Source)
at java.base/java.util.jar.JarFile.<init>(Unknown Source)
at jdk.deploy@10-ea/com.sun.deploy.cache.CachedJarFile.<init>(Unknown Source)
at jdk.deploy@10-ea/com.sun.deploy.cache.CachedJarFile.clone(Unknown Source)
at jdk.deploy@10-ea/com.sun.deploy.net.protocol.jar.DeployURLConnection$1.run(Unknown Source)
at jdk.deploy@10-ea/com.sun.deploy.net.protocol.jar.DeployURLConnection$1.run(Unknown Source)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at jdk.deploy@10-ea/com.sun.deploy.net.protocol.jar.DeployURLConnection.getJarFile(Unknown Source)
at simplewebstart.Main.main(Main.java:19)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at jdk.javaws@10-ea/com.sun.javaws.Launcher.executeApplication(Unknown Source)
at jdk.javaws@10-ea/com.sun.javaws.Launcher.executeMainClass(Unknown Source)
at jdk.javaws@10-ea/com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
at jdk.javaws@10-ea/com.sun.javaws.Launcher.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
#### simplewebstart/Main.java ######
package simplewebstart;

import java.net.JarURLConnection;
import java.net.URL;
import java.util.Enumeration;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;

public class Main
{

public static void main(String[] args) throws Exception
{
Enumeration<URL> packageURLs = Main.class.getClassLoader().getResources("simplewebstart/messages.properties");
while (packageURLs.hasMoreElements())
{
URL url = packageURLs.nextElement();
JarURLConnection jarConnection = (JarURLConnection) url.openConnection();
JarFile jarFile = jarConnection.getJarFile();
Enumeration<JarEntry> jarEntries = jarFile.entries();
while (jarEntries.hasMoreElements())
{
System.out.println(jarEntries.nextElement().getName());
}
}

}

}

#### JNLP ####
<?xml version="1.0" encoding="utf-8"?>
<jnlp spec="6.0+" codebase="http://127.0.0.1:8081/SimpleWebstart/">
  <information>
    <title>SimpleWebstart</title>
    <vendor>Hexagon Geospatial</vendor>
    <homepage href="http://hexagongeospatial.com" />
    <description>GeoMedia Smart Client</description>
    <description kind="tooltip">GeoMedia Smart Client</description>
    <offline-allowed />
    <shortcut online="true">
      <menu submenu="GeoMedia Smart Client" />
    </shortcut>
  </information>
  <security>
    <all-permissions />
  </security>
  <update check="timeout" />
  <resources>
    <jar href="SimpleWebService.jar" />
  </resources>
  <resources>
    <property name="jnlp.packEnabled" value="false" />
    <java version="10+" href="http://java.sun.com/products/autodl/j2se" java-vm-args="--add-modules java.xml.ws" max-heap-size="800m" />
  </resources>
  <application-desc main-class="simplewebstart.Main">
  </application-desc>
</jnlp>
---------- END SOURCE ----------