<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-ce556c24-b05c-449f-9f1b-83fd99b3bb5c" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="ian@iay.org.uk" id="email_ian@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=ian%40iay.org.uk" style="color:#3b73af;; color: #3b73af; text-decoration: none">Ian Young</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/IDP-1274" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-58b4c328-7871-4029-b8a8-31100f8361f1" height="16" width="16" border="0" align="absmiddle" alt="Bug"> IDP-1274</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1274" style="color: #3b73af; text-decoration: none">Re: "illegal reflective access" under Java 9, 10</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin: 10px 0 0 0; margin-top: 0"><a href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu" class="user-hover" rel="cantor.2@osu.edu" style="color: #3b73af; text-decoration: none">Scott Cantor</a>: can you remember in detail what their <tt>SecurityManager</tt> prevented? I note that we don't seem to be configuring the <tt>SecurityManager</tt> itself.</p> <p style="margin: 10px 0 0 0">The Java API (V7 and V9) says this about <tt>setAttribute</tt>, which is where this is being plugged in:<br> </p>
<blockquote style="margin: 10px 0 0 0; border-left: 1px solid #cccccc; color: #707070; margin-left: 19px; padding: 10px 20px">
<p style="margin: 10px 0 0 0; margin-top: 0">Allows the user to set specific attributes on the underlying implementation.</p>
<p style="margin: 10px 0 0 0">All implementations that implement JAXP 1.5 or newer are required to support the <a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_DTD" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>XMLConstants.ACCESS_EXTERNAL_DTD</tt></a> and<a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_SCHEMA" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>XMLConstants.ACCESS_EXTERNAL_SCHEMA</tt></a> properties.</p>
</blockquote> * <p style="margin: 10px 0 0 0"></p>
<blockquote style="margin: 10px 0 0 0; border-left: 1px solid #cccccc; color: #707070; margin-left: 19px; padding: 10px 20px">
<p style="margin: 10px 0 0 0; margin-top: 0">Setting the <a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_DTD" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>XMLConstants.ACCESS_EXTERNAL_DTD</tt></a> property restricts the access to external DTDs, external Entity References to the protocols specified by the property. If access is denied during parsing due to the restriction of this property, <a href="https://docs.oracle.com/javase/9/docs/api/org/xml/sax/SAXException.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>SAXException</tt></a> will be thrown by the parse methods defined by <a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/parsers/DocumentBuilder.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>DocumentBuilder</tt></a>.</p>
</blockquote>
<ul>
<li>
<blockquote style="margin: 10px 0 0 0; margin-top: 0; border-left: 1px solid #cccccc; color: #707070; margin-left: 19px; padding: 10px 20px">
<p style="margin: 10px 0 0 0; margin-top: 0">Setting the <a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_SCHEMA" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>XMLConstants.ACCESS_EXTERNAL_SCHEMA</tt></a> property restricts the access to external Schema set by the schemaLocation attribute to the protocols specified by the property. If access is denied during parsing due to the restriction of this property, <a href="https://docs.oracle.com/javase/9/docs/api/org/xml/sax/SAXException.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>SAXException</tt></a> will be thrown by the parse methods defined by <a href="https://docs.oracle.com/javase/9/docs/api/javax/xml/parsers/DocumentBuilder.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none"><tt>DocumentBuilder</tt></a>.</p>
</blockquote></li>
</ul> <p style="margin: 10px 0 0 0">Is it possible the use of the <tt>SecurityManager</tt> has been subsumed by either this or by some combination of <tt>setFeatures</tt>?</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1274#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-7acfa2f8-d417-4c54-b6e2-61ef6566721f" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1274#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian JIRA <span id="footer-build-information">(v7.4.2#74004-<span title="586975da6d5c632f4f0de24a42c40182e6b9ead0" data-commit-id="586975da6d5c632f4f0de24a42c40182e6b9ead0}">sha1:586975d</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-a1f23382-b63a-472b-8754-44006280b921" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>