Summary
Two time-bombs surfaced during the JDK 25 upgrade (#35). Neither blocks the upgrade —
the suite is green and the server runs — but both change behaviour silently and will
bite harder on future JDKs. This issue tracks them so they get deliberate decisions
instead of rediscovery.
1. Sandbox enforcement is silently gone on JDK 21+ (JEP 411)
DynamicUtil.Sandbox builds its isolation on SecurityManager + AccessController.doPrivileged.
Since JDK 21, System.setSecurityManager() throws UnsupportedOperationException; the
upgrade wrapped that call in try/catch so the server still boots — but the consequence is:
Sandbox.runInSandbox { ... } no longer enforces anything. The permission list it is
given is ignored at runtime.- Dynamic endpoints and dynamic connector methods (user-uploaded Scala/JS/Java executed via
DynamicUtil / InternalConnector) now run unsandboxed, with the full privileges of
the server process.
- The only trace of this is 3 tests in
DynamicUtilTest that skip via
assume(System.getSecurityManager != null, ...).
Options to evaluate:
- Document that
dynamic_* props must stay disabled on production instances unless the
operator accepts unsandboxed execution.
- Move dynamic-code execution out of process (separate hardened worker / container).
- Explore JDK-native alternatives (e.g. running dynamic code under a restricted
java.lang.ClassLoader + module isolation, or GraalVM isolates for the JS path).
2. sun.misc.Unsafe memory-access methods are terminally deprecated (JEP 471)
On JDK 25 the following dependencies warn at runtime that they call
sun.misc.Unsafe::objectFieldOffset, which will be removed in a near-future JDK
(26/27 time frame):
| Library |
Version in use |
Notes |
| Pekko (actor/remote) |
1.1.5 |
fix expected via newer Pekko releases |
| Guava |
(transitive, 25.1-android via Maven; 32.0.0-jre pinned) |
newer versions drop Unsafe |
| GraalVM Truffle |
24.1.2 |
newer GraalVM releases address JEP 471 |
| chill / Kryo |
0.9.3 (Kryo 4) |
old; Kryo 5 line removes Unsafe usage |
No action needed while we are on JDK 25, but the next JDK bump is blocked until these are
upgraded. Treat this table as the checklist for that upgrade wave.
Related
Summary
Two time-bombs surfaced during the JDK 25 upgrade (#35). Neither blocks the upgrade —
the suite is green and the server runs — but both change behaviour silently and will
bite harder on future JDKs. This issue tracks them so they get deliberate decisions
instead of rediscovery.
1. Sandbox enforcement is silently gone on JDK 21+ (JEP 411)
DynamicUtil.Sandboxbuilds its isolation onSecurityManager+AccessController.doPrivileged.Since JDK 21,
System.setSecurityManager()throwsUnsupportedOperationException; theupgrade wrapped that call in try/catch so the server still boots — but the consequence is:
Sandbox.runInSandbox { ... }no longer enforces anything. The permission list it isgiven is ignored at runtime.
DynamicUtil/InternalConnector) now run unsandboxed, with the full privileges ofthe server process.
DynamicUtilTestthat skip viaassume(System.getSecurityManager != null, ...).Options to evaluate:
dynamic_*props must stay disabled on production instances unless theoperator accepts unsandboxed execution.
java.lang.ClassLoader+ module isolation, or GraalVM isolates for the JS path).2.
sun.misc.Unsafememory-access methods are terminally deprecated (JEP 471)On JDK 25 the following dependencies warn at runtime that they call
sun.misc.Unsafe::objectFieldOffset, which will be removed in a near-future JDK(26/27 time frame):
No action needed while we are on JDK 25, but the next JDK bump is blocked until these are
upgraded. Treat this table as the checklist for that upgrade wave.
Related
java.base/java.langopen requirement)