search

jakartaee / faces

Jakarta Faces
Other
109 stars 55 forks source link

Remove references to the Java SecurityManager and associated APIs #1838

Closed volosied closed 8 months ago

volosied commented 1 year ago

Listed under the 4.1 changes, but I don't see any existing issues.

https://jakarta.ee/specifications/faces/4.1/

volosied commented 9 months ago

Security Manger Removed via https://github.com/eclipse-ee4j/mojarra/pull/5373

See

volosied commented 9 months ago

@arjantijms @BalusC I don't see any SecurityManger references in 4.1 / 5.0, so safe to close out?

volosied commented 9 months ago

MyFaces still has references. I'll wait to close this out until we remove it there. Is this more for the IMPL or API?

BalusC commented 9 months ago

I don't see any SecurityManger references in 4.1 / 5.0.

All changes in 4.1 are merged into 5.0. So that's indeed expected.

Is this more for the IMPL or API?

Impl, actually. The API has no SecurityManager references. I'm not sure why it was listed in spec page. Oversight I guess.

volosied commented 9 months ago

Thanks for the quick reply.

MyFaces has a reference or two in the API, but the majority are in the Impl. 

api/src/main/java/jakarta/faces/FactoryFinder.java
123:            if (System.getSecurityManager() != null)

I'm assuming this shouldn't be in the changelog then? MyFaces should be updated to remove it everywhere nonetheless.

pnicolucci commented 9 months ago

1) We don't currently have anything in the ChangeLog: https://github.com/jakartaee/faces/blob/4.1/spec/src/main/asciidoc/ChangeLog.adoc 2) The Release Plan: https://projects.eclipse.org/projects/ee4j.faces/releases/4.1/plan does not mention anything about the SecurityManager. 3) However, https://jakarta.ee/specifications/faces/4.1/ does mention removal of the SecurityManager

We need to determine if we want to declare that Faces 4.1 should remove references to the SecurityManager. As noted previously MyFaces does have references to the SecurityManager in the MyFaces API. If we're all in agreement that removal of the SecurityManager references is ok for Faces 4.1 then I can get a PR up to add it to the ChangeLog and reference this issue and we can close it.

Thoughts @BalusC @arjantijms @tandraschko @volosied ?

arjantijms commented 9 months ago

We need to determine if we want to declare that Faces 4.1 should remove references to the SecurityManager

Absolutely, removing SecurityManager is part of the overal Jakarta EE 11 plan.

pnicolucci commented 9 months ago

I'll open a PR to add this to the changelog

pnicolucci commented 9 months ago

MyFaces issue to implement: https://issues.apache.org/jira/browse/MYFACES-4653

pnicolucci commented 8 months ago

Closing, since this is implemented in both MyFaces and Mojarra, and the Spec Changelog has been updated.