Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8229785 MethodType::fromMethodDescriptorString should require security permission if loader is null
  3. JDK-8230819

Release Note: MethodType::fromMethodDescriptorString Requires "getClassLoader" Permission

    XMLWordPrintable

    Details

    • Type: Sub-task
    • Status: Closed
    • Priority: P4
    • Resolution: Delivered
    • Affects Version/s: 14
    • Fix Version/s: 14
    • Component/s: core-libs

      Description

      `MethodType::fromMethodDescriptorString` has been changed in this release. When a security manager is present and the `loader` parameter is null, it performs a RuntimePermission("getClassLoader") security permission check. This check ensures that access to the system class loader is permitted.

      Existing code that calls `MethodType.fromMethodDescriptorString(desc, null)` might get a `SecurityException` if access to the system class loader is denied. The security policy must be configured to grant the permission. Applications running without a security manager or with a non-null loader are not affected by this change.

        Attachments

          Activity

            People

            Assignee:
            mchung Mandy Chung
            Reporter:
            mchung Mandy Chung
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: