On 29/03/2016 11:03, Robert Gibson wrote:
:
Hi Alan,
Thanks for your quick reply.
Yes, we have code (and depend on libraries) that use, approximately:
com.sun.java.swing.plaf
Are you sure you are using classes in this package directly? The L&F is
usually specified as a String.
com.sun.org.apache.xerces
com.sun.jmx.remote.util
com.sun.management
com.sun.management is a supported/documented API, exported by the
jdk.management module, so you should be okay here, unless you are making
use of some of its internal types.
com.sun.jndi.ldap
Are you making direct use of types in this package? Just curious as
creating the initial context specifies the provider name as String. Also
all the configuration is Strings too.
com.sun.crypto.provider
I'm also curious about this one.
We will at some point get around to re-writing the code that we have control
over but would like to have flexibility over when we do this, and not have it
as a precondition for upgrading our clients to Java 9. Currently it seems that
-XaddExports doesn't have any effect in a JNLP file and I assumed that was a
whitelisting issue with VM arguments and Web Start - but maybe it is supposed
to work at this point?
-XaddExports has not been added to the options allowed to be specified
with the java-vm-args attribute. It probably should be considered so as
to have consistency with the command line (within reason of course,
anything allowed to be specified via java-vm-args requires thinking
about security).
-Alan
