Repository navigation
JarUrlClassLoader rejects valid class names since #52271 - #52284
Merged
philwebb merged 2 commits intoOct 18, 2026
Merged
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
philwebb
added
type: bug
Member
|
We've decided to revert #52271 for now since it's too risky. Whatever we do, we'll test out in 4.2 before considering a backport. |
Closed
Update `LoadableNames` logic to validate class name against rules defined by the "Java Virtual Machine Specification" rather than the "Java Langage Specification". Prior to this commit, restrictions would prevent valid JVM bytecode from running, for example if a `package-info` class was loaded. Signed-off-by: Jan Mohr <jan.mohr.1@web.de> See spring-projectsgh-52284
Add more tests and implement package/module name restrictions. This commit also removes all resource name restrictions which could be risky to enforce. See spring-projectsgh-52284
philwebb
force-pushed
the
loadable-names-jvm-class-names
branch
from
October 18, 2026 22:24
79af7c1 to
868bba7
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+11
to
+25
| name: Read Version | ||
| runs-on: 'ubuntu-latest' | ||
| steps: | ||
| - name: Check Out Code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Read Version From gradle.properties | ||
| id: read-version | ||
| shell: bash | ||
| run: | | ||
| version=$(sed -n 's/version=\(.*\)/\1/p' gradle.properties) | ||
| echo "Version is $version" | ||
| echo "version=$version" >> $GITHUB_OUTPUT | ||
| outputs: | ||
| version: ${{ steps.read-version.outputs.version }} | ||
| publish-gradle-plugin: |
Comment on lines
+26
to
+42
| name: Publish Gradle Plugin | ||
| if: ${{ !vars.COMMERCIAL }} | ||
| needs: | ||
| - read-version | ||
| runs-on: 'ubuntu-latest' | ||
| steps: | ||
| - name: Check Out Code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Publish | ||
| uses: ./.github/actions/publish-gradle-plugin | ||
| with: | ||
| build-number: '2026.4' | ||
| gradle-plugin-publish-key: ${{ secrets.GRADLE_PLUGIN_PUBLISH_KEY }} | ||
| gradle-plugin-publish-secret: ${{ secrets.GRADLE_PLUGIN_PUBLISH_SECRET }} | ||
| jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }} | ||
| plugin-version: ${{ needs.read-version.outputs.version }} | ||
| trigger-docs-build: |
Comment on lines
+55
to
+70
| name: Create GitHub Release | ||
| needs: | ||
| - read-version | ||
| - publish-gradle-plugin | ||
| - trigger-docs-build | ||
| runs-on: 'ubuntu-latest' | ||
| steps: | ||
| - name: Check Out Code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Create GitHub Release | ||
| uses: ./.github/actions/create-github-release | ||
| with: | ||
| commercial: ${{ vars.COMMERCIAL }} | ||
| pre-release: true | ||
| milestone: ${{ needs.read-version.outputs.version }} | ||
| token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }} No newline at end of file |
Member
|
Thanks @janwaleed09! I've attempted to implement package/module name restrictions as well and also included |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #52271 the loader only accepts class names that are Java identifiers, but the JVM allows more than that (JVMS 4.2.2). In an executable jar, OkHttp now fails with
NoClassDefFoundError: okio/internal/-ByteStringNonJs, kotlinx-serialization and Micrometer's Atlas registry fail the same way, and package annotations are gone. I changed the check to only reject what the JVM never allows (an empty name part,;or[), which also covers thepackage-infocase from #52283.