-
CSR
-
Resolution: Approved
-
P4
-
None
-
behavioral
-
minimal
-
doc-only
-
Java API
-
SE
Summary
Remove references to SecurityManager from the AWT Focus Specification.
Problem
JEP 486 disabled the Java SecurityManager and updated API specifications which described how they worked with a SecurityManager, but the AWT Focus Specification was overlooked, even though it is part of the javadoc, likely because it lives in an HTML file in the JDK sources
Solution
Update the Focus Specification to remove references to the SecurityManager
Specification
java/awt/doc-files/FocusSpec.html - test is deleted as shown below
- First note that, because unhindered access to Components in other - contexts represents a security hole, the SecurityManager must grant a - new permission, "replaceKeyboardFocusManager", before client code is - permitted to replace theKeyboardFocusManager
with an arbitrary - subclass instance. Because of the security check, replacing the -KeyboardFocusManager
is not an option for applications that will be - deployed in environments with a SecurityManager, such as applets in a - browser. -- Once installed, a
KeyboardFocusManager
instance has - access to the global focus state via a set of protected functions. - TheKeyboardFocusManager
can only call these functions - if it is installed in the calling thread's context. This ensures - that malicious code cannot circumvent the security check in -KeyboardFocusManager.setCurrentFocusManager
. - AKeyboardFocusManager
should always work with - the global focus state instead of the context focus state. - Failure to do this will lead to incorrect behavior of the -KeyboardFocusManager
.
- csr of
-
JDK-8345001 java/awt/doc-files/FocusSpec.html has SecurityManager references
- Resolved