Problem 1.
If you name a class sun.misc.Unsafe and put it in your classpath, it does not change the fact, any code calling that will still be calling the real Unsafe. But it does hide it from forbidden-apis!!!
This is because classloader order, when the application is actually used, is Bootstrap->Extensions->System (App), as explained here: http://docs.oracle.com/javase/tutorial/ext/basics/load.html
But forbidden-apis checks the wrong order, it checks the ones you provide first, because it uses lookupRelatedClass(): https://github.com/policeman-tools/forbidden-apis/blob/9de5e1fccb1755d58a271870a2dee3a19f0d51ec/src/main/java/de/thetaphi/forbiddenapis/Checker.java#L303-L306
This causes the interesting scenario when trying to cleanup crazy classpaths, where removing a jar can cause new violations in your build :)
Problem 2:
The current isRuntimeClass() does not seem to check for extensions at all, but only against bootstrap classpath. This hides additional internal accesses, e.g. jdk.nashorn.internal, which will cause a SecurityException if you try to use it.
So can we use the following code on pre-jigsaw, to identify extensions jars and treat them as "internal" too? I think this extensions idea goes away with jigsaw, and everything is just modules, so it should not be a problem that we can't get extensions jars/directories there.
// of course with proper checks and best-effort, not guaranteed but works.
URLClassLoader loader = (URLClassLoader) ClassLoader.getSystemClassLoader().getParent();
URL extensions[] = loader.getURLs();
Problem 3:
Internal checking has a hardcoded list of simple patterns: https://github.com/policeman-tools/forbidden-apis/blob/f7dce219c725add93de3ec4545d94f164ef032df/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java#L33
Can we use java.security.Security.getProperty("package.access") instead? That property is set by the JDK, in e.g. the jre/lib/security/java.security configuration file for security checks against internal apis:
#
# List of comma-separated packages that start with or equal this string
# will cause a security exception to be thrown when
# passed to checkPackageAccess unless the
# corresponding RuntimePermission ("accessClassInPackage."+package) has
# been granted.
package.access=sun.,\
com.sun.xml.internal.,\
com.sun.imageio.,\
com.sun.istack.internal.,\
com.sun.jmx.,\
com.sun.media.sound.,\
com.sun.naming.internal.,\
com.sun.proxy.,\
... (many lines) ...
bug enhancement
1 Oct 26, 2022
1 Oct 18, 2021
5 Sep 23, 2022
1.3k Dec 21, 2022
278 Dec 13, 2022
91 Dec 22, 2022
2 Oct 9, 2022
47 Dec 29, 2022
6 Apr 29, 2022
3 Sep 17, 2021
6 Dec 15, 2022
4 Jan 13, 2022
7 Dec 20, 2022
8 Mar 19, 2022
20 Dec 28, 2022
4 Feb 23, 2022
14 Jan 9, 2023
14.8k Dec 30, 2022
7 Dec 21, 2021