Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v5]

2024-11-20 Thread Daniel Fuchs
On Wed, 20 Nov 2024 16:40:43 GMT, Aleksei Efimov wrote: >> src/jdk.naming.rmi/share/classes/module-info.java line 64: >> >>> 62: * location} specified in the reference can be supported by a custom >>> implementation of {@link >>> 63: * javax.naming.spi.ObjectFactoryBuilder}. If a location is

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v5]

2024-11-20 Thread Daniel Fuchs
On Wed, 20 Nov 2024 16:25:56 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v5]

2024-11-20 Thread Daniel Fuchs
On Wed, 20 Nov 2024 16:25:56 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v5]

2024-11-20 Thread Aleksei Efimov
On Wed, 20 Nov 2024 16:31:44 GMT, Daniel Fuchs wrote: >> Aleksei Efimov has updated the pull request incrementally with one >> additional commit since the last revision: >> >> change jdk.naming.rmi per Daniel's suggestion > > src/jdk.naming.rmi/share/classes/module-info.java line 64: > >> 62

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v5]

2024-11-20 Thread Aleksei Efimov
> This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI > JDK providers, and contains the following changes: > - The following two properties are removed: > - `com.sun.jndi.ldap.object.trustURLCodebase` > - `com.sun.jndi.rmi.object.trustURLCodebase` > - JNDIs object

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v4]

2024-11-20 Thread Aleksei Efimov
On Wed, 20 Nov 2024 14:13:59 GMT, Daniel Fuchs wrote: >> Aleksei Efimov has updated the pull request incrementally with two >> additional commits since the last revision: >> >> - Docs and comments update >> - Revert VersionHelper.createThread removal > > src/jdk.naming.rmi/share/classes/modul

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-20 Thread Roger Riggs
On Wed, 20 Nov 2024 11:38:35 GMT, Daniel Fuchs wrote: >> src/java.naming/share/classes/com/sun/naming/internal/VersionHelper.java >> line 163: >> >>> 161: InputStream getJavaHomeConfStream(String filename) { >>> 162: try { >>> 163: String javahome = System.getProperty("j

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v4]

2024-11-20 Thread Daniel Fuchs
On Wed, 20 Nov 2024 13:06:57 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-20 Thread Aleksei Efimov
On Tue, 19 Nov 2024 20:42:04 GMT, Roger Riggs wrote: >> Aleksei Efimov has updated the pull request incrementally with one >> additional commit since the last revision: >> >> clarify factory location usages in NamingManager and jdk.naming.rmi >> module-info > > src/java.naming/share/classes/

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-20 Thread Aleksei Efimov
On Wed, 20 Nov 2024 11:33:19 GMT, Daniel Fuchs wrote: >> src/java.naming/share/classes/com/sun/jndi/ldap/Connection.java line 262: >> >>> 260: } >>> 261: >>> 262: worker = new Thread(this); >> >> Rataining a static factory for thread may use useful to be able to customize >> t

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v4]

2024-11-20 Thread Aleksei Efimov
> This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI > JDK providers, and contains the following changes: > - The following two properties are removed: > - `com.sun.jndi.ldap.object.trustURLCodebase` > - `com.sun.jndi.rmi.object.trustURLCodebase` > - JNDIs object

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v2]

2024-11-20 Thread Daniel Fuchs
On Tue, 19 Nov 2024 00:53:22 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-20 Thread Daniel Fuchs
On Tue, 19 Nov 2024 20:38:02 GMT, Roger Riggs wrote: >> Aleksei Efimov has updated the pull request incrementally with one >> additional commit since the last revision: >> >> clarify factory location usages in NamingManager and jdk.naming.rmi >> module-info > > src/java.naming/share/classes/

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-20 Thread Daniel Fuchs
On Tue, 19 Nov 2024 20:33:35 GMT, Roger Riggs wrote: >> Aleksei Efimov has updated the pull request incrementally with one >> additional commit since the last revision: >> >> clarify factory location usages in NamingManager and jdk.naming.rmi >> module-info > > src/java.naming/share/classes/

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-19 Thread Roger Riggs
On Tue, 19 Nov 2024 19:22:44 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-19 Thread Daniel Fuchs
On Tue, 19 Nov 2024 19:22:44 GMT, Aleksei Efimov wrote: >> This PR permanently disable remote code downloading in JNDI/LDAP and >> JNDI/RMI JDK providers, and contains the following changes: >> - The following two properties are removed: >> - `com.sun.jndi.ldap.object.trustURLCodebase` >>

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v3]

2024-11-19 Thread Aleksei Efimov
> This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI > JDK providers, and contains the following changes: > - The following two properties are removed: > - `com.sun.jndi.ldap.object.trustURLCodebase` > - `com.sun.jndi.rmi.object.trustURLCodebase` > - JNDIs object

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI [v2]

2024-11-18 Thread Aleksei Efimov
> This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI > JDK providers, and contains the following changes: > - The following two properties are removed: > - `com.sun.jndi.ldap.object.trustURLCodebase` > - `com.sun.jndi.rmi.object.trustURLCodebase` > - JNDIs object

Re: RFR: 8338536: Permanently disable remote code downloading in JNDI

2024-11-18 Thread Daniel Fuchs
On Fri, 15 Nov 2024 17:03:50 GMT, Aleksei Efimov wrote: > This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI > JDK providers, and contains the following changes: > - The following two properties are removed: > - `com.sun.jndi.ldap.object.trustURLCodebase` > - `

RFR: 8338536: Permanently disable remote code downloading in JNDI

2024-11-15 Thread Aleksei Efimov
This PR permanently disable remote code downloading in JNDI/LDAP and JNDI/RMI JDK providers, and contains the following changes: - The following two properties are removed: - `com.sun.jndi.ldap.object.trustURLCodebase` - `com.sun.jndi.rmi.object.trustURLCodebase` - JNDIs object factories l