-
CSR
-
Resolution: Approved
-
P4
-
None
-
behavioral
-
minimal
-
doc-only
-
Java API
-
SE
Summary
Remove references to SecurityManager from the AWT Focus Specification.
Problem
JEP 486 disabled the Java SecurityManager and updated API specifications which described how they worked with a SecurityManager, but the AWT Focus Specification was overlooked, even though it is part of the javadoc, likely because it lives in an HTML file in the JDK sources
Solution
Update the Focus Specification to remove references to the SecurityManager
Specification
java/awt/doc-files/FocusSpec.html - test is deleted as shown below
- First note that, because unhindered access to Components in other - contexts represents a security hole, the SecurityManager must grant a - new permission, "replaceKeyboardFocusManager", before client code is - permitted to replace theKeyboardFocusManagerwith an arbitrary - subclass instance. Because of the security check, replacing the -KeyboardFocusManageris not an option for applications that will be - deployed in environments with a SecurityManager, such as applets in a - browser. -- Once installed, a
KeyboardFocusManagerinstance has - access to the global focus state via a set of protected functions. - TheKeyboardFocusManagercan only call these functions - if it is installed in the calling thread's context. This ensures - that malicious code cannot circumvent the security check in -KeyboardFocusManager.setCurrentFocusManager. - AKeyboardFocusManagershould always work with - the global focus state instead of the context focus state. - Failure to do this will lead to incorrect behavior of the -KeyboardFocusManager.
- csr of
-
JDK-8345001 java/awt/doc-files/FocusSpec.html has SecurityManager references
-
- Resolved
-