Movatterモバイル変換

Oracle recommends that the JDK is updated with each Critical Patch Update.In order to determine if a release is the latest, theSecurity Baseline page canbe used to determine which is the latest version for each release family.

Critical patch updates, which contain security vulnerability fixes, are announced one year in advance onCritical Patch Updates, Security Alerts and Bulletins.It is not recommended that this JDK (version 17.0.3) be used after the next critical patch update scheduledfor July 19, 2022.

Three processing limits have been added to the XML libraries. These are:

• jdk.xml.xpathExprGrpLimit

Description: Limits the number of groups an XPath expression can contain.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, aNumberFormatException is thrown. Default 10.

• jdk.xml.xpathExprOpLimit

Description: Limits the number of operators an XPath expression can contain.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, aNumberFormatException is thrown. Default 100.

• jdk.xml.xpathTotalOpLimit

Description: Limits the total number of XPath operators in an XSL Stylesheet.

Type: integer

Value: A positive integer. A value less than or equal to 0 indicates no limit. If the value is not an integer, aNumberFormatException is thrown. Default 10000.

Supported processors

• jdk.xml.xpathExprGrpLimit andjdk.xml.xpathExprOpLimit are supported by the XPath processor.

• All three limits are supported by the XSLT processor.

Setting properties

For the XSLT processor, the properties can be changed through theTransformerFactory. For example,

        TransformerFactory factory = TransformerFactory.newInstance();        factory.setAttribute("jdk.xml.xpathTotalOpLimit", "1000");

For both the XPath and XSLT processors, the properties can be set through the system property andjaxp.properties configuration file located in theconf directory of the Java installation. For example,

        System.setProperty("jdk.xml.xpathExprGrpLimit", "20");

or in thejaxp.properties file,

        jdk.xml.xpathExprGrpLimit=20

There are two known issues:

1. An XPath expression that contains a short form of the parent axis ".." can return incorrect results. SeeJDK-8284920 for details.
2. An invalid XPath expression that ends with a relational operator such as ‘<’ ‘>’ and ‘=’ will cause the processor to erroneously throw StringIndexOutOfBoundsException instead of XPathExpressionException. SeeJDK-8284548 for details.

On macOS, only certificates with proper trust settings in the user keychain will be exposed as trusted certificate entries in the KeychainStore type of keystore. Also, calling theKeyStore::setCertificateEntry method or thekeytool -importcert command on a KeychainStore keystore now fails with aKeyStoreException. Instead, call the macOS "security add-trusted-cert" command to add a trusted certificate into the user keychain.

The parsing of URLs in the LDAP, DNS, and RMI built-in JNDI providers has been made more strict. The strength of the parsing can be controlled by system properties:

  -Dcom.sun.jndi.ldapURLParsing="legacy" | "compat" | "strict"    (to control "ldap:" URLs)  -Dcom.sun.jndi.dnsURLParsing="legacy" | "compat" | "strict"     (to control "dns:" URLs)  -Dcom.sun.jndi.rmiURLParsing="legacy" | "compat" | "strict"     (to control "rmi:" URLs)

The default value is "compat" for all of the three providers.

• The "legacy" mode turns the new validation off.
• The "compat" mode limits incompatibilities.
• The "strict" mode is stricter and may cause regression by rejecting URLs that an application might consider as valid.

In "compat" and "strict" mode, more validation is performed. As an example, in the URL authority component, the new parsing only accepts brackets around IPv6 literal addresses. Developers are encouraged to usejava.net.URI constructors or its factory method to build URLs rather than handcrafting URL strings.

If an illegal URL string is found, ajava.lang.IllegalArgumentException or ajavax.naming.NamingException (or a subclass of it) is raised.