8368050: Validation missing in ClassFile signature factories #27380

liach · 2025-09-18T23:59:44Z

The Signature modeling in the ClassFile API is missing some validations required by JVMS, notably identifier character restrictions and void type restrictions. In addition, the model currently uses ClassDesc to indicate a simple name for an inner class signature, which is incorrect, and this patch proposes to deprecate that API for removal.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8368051 to be approved

Issues

JDK-8368050: Validation missing in ClassFile signature factories (Bug - P4)
JDK-8368051: Validation missing in ClassFile signature factories (CSR)

Reviewers

Adam Sotona (@asotona - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/27380/head:pull/27380
$ git checkout pull/27380

Update a local copy of the PR:
$ git checkout pull/27380
$ git pull https://git.openjdk.org/jdk.git pull/27380/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 27380

View PR using the GUI difftool:
$ git pr show -t 27380

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/27380.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-09-19T00:01:16Z

👋 Welcome back liach! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-09-19T00:02:47Z

@liach This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8368050: Validation missing in ClassFile signature factories

Reviewed-by: asotona

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 36 new commits pushed to the master branch:

61c5245: 8367869: Test java/io/FileDescriptor/Sync.java timed out
b11b1f1: 8343221: IOUtils.copyRecursive() doesn't create parent directories
4882559: 8367942: Add API note discussing Double.compareTo total order and IEEE 754 total order
... and 33 more: https://git.openjdk.org/jdk/compare/3d4e0491940c4b4a05ac84006933d939370e7e2b...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-09-19T00:03:30Z

@liach The following label will be automatically applied to this pull request:

core-libs

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-09-19T00:09:13Z

Webrevs

asotona · 2025-09-19T07:03:56Z

src/java.base/share/classes/java/lang/classfile/Signature.java

         * {@return a class type signature}
         *
         * @param outerType signature of the outer type, may be {@code null}
+         *        to indicate this is a top-level class or interface


Actually here is the ambiguity. Null outer type is more than frequently used also for inner classes.
Signatures of inner classes are mainly encoded without the outer type and with the $-notation of the outer$inner as the class name.

Clarified by introducing examples of signature strings and on the className/outerType.

asotona · 2025-09-19T07:14:52Z

src/java.base/share/classes/java/lang/classfile/Signature.java

         */
        public static ClassTypeSig of(ClassTypeSig outerType, String className, TypeArg... typeArgs) {
-            requireNonNull(className);
-            return new SignaturesImpl.ClassTypeSigImpl(Optional.ofNullable(outerType), className.replace(".", "/"), List.of(typeArgs));


We should declare that the method does not accept binary class names, If we remove the conversion.
And that seems to be a significant compatibility change.

Yes, this spec links to "identifiers" which explicitly rejects dots. Added this risk in the CSR. I think we should be fine here.

src/java.base/share/classes/jdk/internal/classfile/impl/ClassRemapperImpl.java

…lasstypesig-factory-classdesc

asotona

Looks good to me.

liach · 2025-09-23T12:45:27Z

Thanks for the reviews!

/integrate

openjdk · 2025-09-23T12:48:01Z

Going to push as commit f9b91a7.
Since your change was applied there have been 50 commits pushed to the master branch:

4bc86a2: 8367948: JFR: MethodTrace threshold setting has no effect
02c78bb: 8367731: G1: Make G1CollectionSet manage the young gen cset group
dbf787c: 8368326: Don't export unresolved make variables from configure
... and 47 more: https://git.openjdk.org/jdk/compare/3d4e0491940c4b4a05ac84006933d939370e7e2b...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-09-23T12:48:10Z

@liach Pushed as commit f9b91a7.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8368050: Validation missing in ClassFile signature factories

074c541

openjdk bot added csr Pull request needs approved CSR before integration core-libs [email protected] labels Sep 19, 2025

openjdk bot added the rfr Pull request is ready for review label Sep 19, 2025

liach added 2 commits September 18, 2025 19:10

More bugs

8de7e6d

Fix links

3acdfe4

asotona reviewed Sep 19, 2025

View reviewed changes

src/java.base/share/classes/jdk/internal/classfile/impl/ClassRemapperImpl.java Outdated Show resolved Hide resolved

liach added 3 commits September 19, 2025 14:03

Merge branch 'master' of https://github.com/openjdk/jdk into fix/cf-c…

16b65d7

…lasstypesig-factory-classdesc

Fix bad docs and add more to clarify class type sig

b21f811

More fixes

3559c8d

asotona approved these changes Sep 22, 2025

View reviewed changes

openjdk bot mentioned this pull request Sep 22, 2025

8368331: ClassFile Signature parsing fails for type parameter with no supertype #27439

Open

3 tasks

openjdk bot added ready Pull request is ready to be integrated and removed csr Pull request needs approved CSR before integration labels Sep 23, 2025

openjdk bot added the integrated Pull request has been integrated label Sep 23, 2025

openjdk bot closed this Sep 23, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Sep 23, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

8368050: Validation missing in ClassFile signature factories #27380

8368050: Validation missing in ClassFile signature factories #27380

liach commented Sep 18, 2025 •

edited by openjdk bot

Loading

Uh oh!

bridgekeeper bot commented Sep 19, 2025

Uh oh!

openjdk bot commented Sep 19, 2025 •

edited

Loading

Uh oh!

openjdk bot commented Sep 19, 2025 •

edited

Loading

Uh oh!

mlbridge bot commented Sep 19, 2025 •

edited

Loading

Uh oh!

asotona Sep 19, 2025

Uh oh!

liach Sep 19, 2025

Uh oh!

asotona Sep 19, 2025 •

edited

Loading

Uh oh!

liach Sep 19, 2025

Uh oh!

Uh oh!

asotona left a comment

Uh oh!

liach commented Sep 23, 2025

Uh oh!

openjdk bot commented Sep 23, 2025

Uh oh!

openjdk bot commented Sep 23, 2025

Uh oh!

Uh oh!

8368050: Validation missing in ClassFile signature factories #27380

8368050: Validation missing in ClassFile signature factories #27380

Conversation

liach commented Sep 18, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Sep 19, 2025

Uh oh!

openjdk bot commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mlbridge bot commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

asotona Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

liach Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

asotona Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liach Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

asotona left a comment

Choose a reason for hiding this comment

Uh oh!

liach commented Sep 23, 2025

Uh oh!

openjdk bot commented Sep 23, 2025

Uh oh!

openjdk bot commented Sep 23, 2025

Uh oh!

Uh oh!

liach commented Sep 18, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Sep 19, 2025 •

edited

Loading

openjdk bot commented Sep 19, 2025 •

edited

Loading

mlbridge bot commented Sep 19, 2025 •

edited

Loading

asotona Sep 19, 2025 •

edited

Loading