On Mon, 25 Nov 2024 17:40:12 GMT, Sean Mullan <mul...@openjdk.org> wrote:
> Now that JEP 486 has been integrated, the `javax.security` package > implementation dependencies on `System.getSecurityManager`, > `AccessController.doPrivileged` and `AccessControlContext` can be removed. > > Most of the changes are straightforward: removal of code calling > `System.getSecurityManager()` and unwrapping of code inside > `AccessController.doPrivileged`. However, two changes involved slightly more > complicated work: > > 1. `javax.security.auth.login.Configuration` and > `javax.security.auth.login.LoginContext` do not need to capture the caller's > access control context anymore. > 2. The `SecureSet` implementation in `javax.security.auth.Subject` is greatly > simplified because it does not do security checks anymore. I went through the changes and it looks a good cleanup. I think it would good to have a second reviewer, esp. for Subject and LoginContext, as there is a lot in this cleanup. ------------- Marked as reviewed by alanb (Reviewer). PR Review: https://git.openjdk.org/jdk/pull/22368#pullrequestreview-2459281282
