On Wed, 26 Aug 2026 07:17:36 GMT, Prasanta Sadhukhan <[email protected]> wrote:
> We stand by the implementation to provide a secure-by-default behaviour and > if somebody wants to opt for the legacy insecure way of browsing I do not think the current implementation is more secure. I already provided the feedback on this change when it was integrated, It also contradicts the spec. It is not "legacy" or insecure and another libraries provided the same functionality, and it was discussed here and there like https://bugs.openjdk.org/browse/JDK-6833958. As I mentioned above, the patch does something similar to changing Runtime.exec() to always open files in a different way, even though both are specified to run applications and are implemented that way on all three platforms. > We cannot change the spec for this change as we intend to backport this to > other releases.. The spec is already broken. btw, I just want to make sure that the old report was not AI slop that was accidentally accepted ------------- PR Comment: https://git.openjdk.org/jdk/pull/32247#issuecomment-5430640536
