Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987855642 Thanks Robert! As always: nice discussions. I will improve the signatures file documentation to give a hint how the inner class binary names look like (give an example). -- This is

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
rmuir merged PR #14811: URL: https://github.com/apache/lucene/pull/14811 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@lucene.apach

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
rmuir commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987609996 With help of @uschindler, this check is a bit different than how the error-prone rules implement it, but more thorough. The stated goal of the error-prone check is to prevent turnin

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
github-actions[bot] commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987598490 This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156684715 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,9 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.l

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156654935 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
github-actions[bot] commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987524629 This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
rmuir commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156628908 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.lang.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987067126 > Source of the check: https://github.com/google/error-prone/blob/master/core/src/main/java/com/google/errorprone/bugpatterns/BanClassLoader.java > > It also checks for explicit

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987082206 Final note abozut subclasses: You need to add all ctors of sublasses of Classloader which reside in JDK. Now you might argue that one could define a subclass in user code (extending U

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2987071310 In addition the list on errorprone is incomplete. Since Java 16 there's `Lookup#defineHiddenClass(**) & others (see expressions module). -- This is an automated message from the Apa

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156332399 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156332399 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-19 Thread via GitHub
uschindler commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2156288518 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-18 Thread via GitHub
rmuir commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2985845882 Source of the check: https://github.com/google/error-prone/blob/master/core/src/main/java/com/google/errorprone/bugpatterns/BanClassLoader.java It also checks for explicit `extends U

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-18 Thread via GitHub
github-actions[bot] commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2985834553 This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-18 Thread via GitHub
rmuir commented on code in PR #14811: URL: https://github.com/apache/lucene/pull/14811#discussion_r2155576445 ## gradle/validation/forbidden-apis/defaults.all.txt: ## @@ -76,3 +76,15 @@ java.lang.Math#fma(float,float,float) java.lang.Math#fma(double,double,double) java.lang.

Re: [PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-18 Thread via GitHub
github-actions[bot] commented on PR #14811: URL: https://github.com/apache/lucene/pull/14811#issuecomment-2985810339 This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop

[PR] error-prone: implement BanClassLoader with forbidden-apis instead [lucene]

2025-06-18 Thread via GitHub
rmuir opened a new pull request, #14811: URL: https://github.com/apache/lucene/pull/14811 This rule is attempting to ban dangerous usages of ClassLoader which could be security hazard (IMO a good idea). forbidden APIs is a good tool for banning, just like we use forbidden-apis to ban JNDI a