8344365: SecurityManager cleanups in java.sql and java.sql.rowset modules

Reviewed-by: rriggs, bchristi

Author: Eirik Bjørsnøs

src/java.sql.rowset/share/classes/com/sun/rowset/CachedRowSetImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,16 +31,12 @@
 import java.math.*;
 import java.util.*;
 import java.text.*;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 
 import javax.sql.rowset.*;
 import javax.sql.rowset.spi.*;
 import javax.sql.rowset.serial.*;
 import com.sun.rowset.internal.*;
 import com.sun.rowset.providers.*;
-import sun.reflect.misc.ReflectUtil;
 
 import static java.nio.charset.StandardCharsets.US_ASCII;
 
@@ -357,7 +353,6 @@ public class CachedRowSetImpl extends BaseRowSet implements RowSet, RowSetIntern
      * <P>
      * @throws SQLException if an error occurs
      */
-    @SuppressWarnings("removal")
     public CachedRowSetImpl() throws SQLException {
 
         try {
@@ -367,16 +362,7 @@ public CachedRowSetImpl() throws SQLException {
         }
 
         // set the Reader, this maybe overridden latter
-        try {
-            provider = AccessController.doPrivileged(new PrivilegedExceptionAction<>() {
-                @Override
-                public SyncProvider run() throws SyncFactoryException {
-                    return SyncFactory.getInstance(DEFAULT_SYNC_PROVIDER);
-                }
-            }, null, new RuntimePermission("accessClassInPackage.com.sun.rowset.providers"));
-        } catch (PrivilegedActionException pae) {
-            throw (SyncFactoryException) pae.getException();
-        }
+        provider = SyncFactory.getInstance(DEFAULT_SYNC_PROVIDER);
 
         if (!(provider instanceof RIOptimisticProvider)) {
             throw new SQLException(resBundle.handleGetObject("cachedrowsetimpl.invalidp").toString());
@@ -2976,7 +2962,6 @@ public Object getObject(int columnIndex) throws SQLException {
                 // create new instance of the class
                 SQLData obj = null;
                 try {
-                    ReflectUtil.checkPackageAccess(c);
                     @SuppressWarnings("deprecation")
                     Object tmp = c.newInstance();
                     obj = (SQLData) tmp;
@@ -5726,7 +5711,6 @@ public Object getObject(int columnIndex,
                 // create new instance of the class
                 SQLData obj = null;
                 try {
-                    ReflectUtil.checkPackageAccess(c);
                     @SuppressWarnings("deprecation")
                     Object tmp = c.newInstance();
                     obj = (SQLData) tmp;

src/java.sql.rowset/share/classes/com/sun/rowset/internal/CachedRowSetWriter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -29,7 +29,6 @@
 import javax.sql.*;
 import java.util.*;
 import java.io.*;
-import sun.reflect.misc.ReflectUtil;
 
 import com.sun.rowset.*;
 import java.text.MessageFormat;
@@ -575,7 +574,6 @@ private boolean updateOriginalRow(CachedRowSet crs)
                         // create new instance of the class
                         SQLData obj = null;
                         try {
-                            ReflectUtil.checkPackageAccess(c);
                             @SuppressWarnings("deprecation")
                             Object tmp = c.newInstance();
                             obj = (SQLData)tmp;

src/java.sql.rowset/share/classes/javax/sql/rowset/RowSetProvider.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,13 +25,9 @@
 
 package javax.sql.rowset;
 
-import java.security.AccessController;
-import java.security.PrivilegedAction;
 import java.sql.SQLException;
-import java.util.PropertyPermission;
 import java.util.ServiceConfigurationError;
 import java.util.ServiceLoader;
-import sun.reflect.misc.ReflectUtil;
 
 /**
  * A factory API that enables applications to obtain a
@@ -68,7 +64,7 @@ public class RowSetProvider {
 
     static {
         // Check to see if the debug property is set
-        String val = getSystemProperty(ROWSET_DEBUG_PROPERTY);
+        String val = System.getProperty(ROWSET_DEBUG_PROPERTY);
         // Allow simply setting the prop to turn on debug
         debug = val != null && !"false".equals(val);
     }
@@ -128,7 +124,8 @@ public static RowSetFactory newFactory()
         String factoryClassName = null;
         try {
             trace("Checking for Rowset System Property...");
-            factoryClassName = getSystemProperty(ROWSET_FACTORY_NAME);
+
+            factoryClassName = System.getProperty(ROWSET_FACTORY_NAME);
             if (factoryClassName != null) {
                 trace("Found system property, value=" + factoryClassName);
                 if (factoryClassName.equals(ROWSET_FACTORY_IMPL)) {
@@ -193,11 +190,6 @@ public static RowSetFactory newFactory(String factoryClassName, ClassLoader cl)
         if(factoryClassName == null) {
             throw new SQLException("Error: factoryClassName cannot be null");
         }
-        try {
-            ReflectUtil.checkPackageAccess(factoryClassName);
-        } catch (@SuppressWarnings("removal") java.security.AccessControlException e) {
-            throw new SQLException("Access Exception",e);
-        }
 
         try {
             // getFactoryClass takes care of adding the read edge if
@@ -225,22 +217,14 @@ public static RowSetFactory newFactory(String factoryClassName, ClassLoader cl)
      * @return The ClassLoader to use.
      *
      */
-    @SuppressWarnings("removal")
-    private static ClassLoader getContextClassLoader() throws SecurityException {
-        return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() {
-
-            public ClassLoader run() {
-                ClassLoader cl = null;
-
-                cl = Thread.currentThread().getContextClassLoader();
+    private static ClassLoader getContextClassLoader() {
+        ClassLoader cl = Thread.currentThread().getContextClassLoader();
 
-                if (cl == null) {
-                    cl = ClassLoader.getSystemClassLoader();
-                }
+        if (cl == null) {
+            cl = ClassLoader.getSystemClassLoader();
+        }
 
-                return cl;
-            }
-        });
+        return cl;
     }
 
     /**
@@ -276,7 +260,6 @@ private static Class<?> getFactoryClass(String factoryClassName, ClassLoader cl,
             }
         }
 
-        ReflectUtil.checkPackageAccess(factoryClass);
         return factoryClass;
     }
 
@@ -302,32 +285,6 @@ private static RowSetFactory loadViaServiceLoader() throws SQLException {
 
     }
 
-    /**
-     * Returns the requested System Property.  If a {@code SecurityException}
-     * occurs, just return NULL
-     * @param propName - System property to retrieve
-     * @return The System property value or NULL if the property does not exist
-     * or a {@code SecurityException} occurs.
-     */
-    @SuppressWarnings("removal")
-    private static String getSystemProperty(final String propName) {
-        String property = null;
-        try {
-            property = AccessController.doPrivileged(new PrivilegedAction<String>() {
-
-                public String run() {
-                    return System.getProperty(propName);
-                }
-            }, null, new PropertyPermission(propName, "read"));
-        } catch (SecurityException se) {
-            trace("error getting " + propName + ":  "+ se);
-            if (debug) {
-                se.printStackTrace();
-            }
-        }
-        return property;
-    }
-
     /**
      * Debug routine which will output tracing if the System Property
      * -Djavax.sql.rowset.RowSetFactory.debug is set

src/java.sql.rowset/share/classes/javax/sql/rowset/serial/SQLInputImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -27,7 +27,6 @@
 import java.sql.*;
 import java.util.Arrays;
 import java.util.Map;
-import sun.reflect.misc.ReflectUtil;
 
 /**
  * An input stream used for custom mapping user-defined types (UDTs).
@@ -477,7 +476,6 @@ public Object readObject() throws SQLException {
                 // create new instance of the class
                 SQLData obj = null;
                 try {
-                    ReflectUtil.checkPackageAccess(c);
                     @SuppressWarnings("deprecation")
                     Object tmp = c.newInstance();
                     obj = (SQLData)tmp;

src/java.sql.rowset/share/classes/javax/sql/rowset/serial/SerialJavaObject.java

@@ -30,9 +30,6 @@
 import java.util.Arrays;
 import java.util.Vector;
 import javax.sql.rowset.RowSetWarning;
-import jdk.internal.reflect.CallerSensitive;
-import jdk.internal.reflect.Reflection;
-import sun.reflect.misc.ReflectUtil;
 
 /**
  * A serializable mapping in the Java programming language of an SQL
@@ -125,23 +122,9 @@ public Object getObject() throws SerialException {
      * the serialized object
      * @see Class#getFields
      */
-    @CallerSensitive
     public Field[] getFields() throws SerialException {
         if (fields != null) {
             Class<?> c = this.obj.getClass();
-            @SuppressWarnings("removal")
-            SecurityManager sm = System.getSecurityManager();
-            if (sm != null) {
-                /*
-                 * Check if the caller is allowed to access the specified class's package.
-                 * If access is denied, throw a SecurityException.
-                 */
-                Class<?> caller = Reflection.getCallerClass();
-                if (ReflectUtil.needsPackageAccessCheck(caller.getClassLoader(),
-                                                        c.getClassLoader())) {
-                    ReflectUtil.checkPackageAccess(c);
-                }
-            }
             return c.getFields();
         } else {
             throw new SerialException("SerialJavaObject does not contain" +