From 9f001e5e28ae3290257ac522e7139e2a12d59e39 Mon Sep 17 00:00:00 2001
From: Brad Walker <bwalker@musings.com>
Date: Fri, 26 Dec 2025 16:04:18 -0700
Subject: [PATCH] cleanup: Remove securityManager use on startup

desc: This change removes the use of securityManager on startup of netbeans. This is a fairly simple change but had far reaching impacts as it deals w/ startup. For this reason, I created this change just for this issue.
---
 harness/apisupport.harness/arch.xml           | 13 ----
 .../modules/apisupport/jnlplauncher/Main.java | 19 ------
 harness/apisupport.harness/release/jnlp.xml   | 11 ----
 .../jnlplauncher/FixPolicyTest.java           | 59 -------------------
 4 files changed, 102 deletions(-)
 delete mode 100644 harness/apisupport.harness/test/unit/src/org/netbeans/modules/apisupport/jnlplauncher/FixPolicyTest.java

diff --git a/harness/apisupport.harness/arch.xml b/harness/apisupport.harness/arch.xml
index 9dce334136f0..3e6a949257f9 100644
--- a/harness/apisupport.harness/arch.xml
+++ b/harness/apisupport.harness/arch.xml
@@ -522,7 +522,6 @@
 -->
  <answer id="exec-property">
   <p>
-   
     <api type="export" group="systemproperty" name="netbeans.user" category="devel">
         During runtime the JNLP launcher enhances the behaviour of the <code>netbeans.user</code>
         property as defined in the NetBeans core. In addition to standard
@@ -531,18 +530,6 @@
         with the correct location of user directory.
     </api>
   </p>
-  
-  <p>
-   
-    <api type="export" group="systemproperty" name="netbeans.jnlp.fixPolicy" category="devel">
-        During runtime the JNLP launcher checks whether value <code>true</code> is assigned
-        to this system property. If it is "true" a special security policy is applied
-        for all the code base - it is granting all permissions to all code bases.
-        <strong>Use with care!</strong>. It allows you e.g. to have the module
-        jar files unsigned (they must also not require the all-permissions in
-        their .jnlp file for this to to work).
-    </api>
-  </p>
  </answer>
 
 
diff --git a/harness/apisupport.harness/jnlp-src/org/netbeans/modules/apisupport/jnlplauncher/Main.java b/harness/apisupport.harness/jnlp-src/org/netbeans/modules/apisupport/jnlplauncher/Main.java
index 187dbcd012ea..de3e475755f5 100644
--- a/harness/apisupport.harness/jnlp-src/org/netbeans/modules/apisupport/jnlplauncher/Main.java
+++ b/harness/apisupport.harness/jnlp-src/org/netbeans/modules/apisupport/jnlplauncher/Main.java
@@ -21,7 +21,6 @@
 package org.netbeans.modules.apisupport.jnlplauncher;
 
 import java.io.File;
-import java.security.Policy;
 
 /** The JNLP entry point. Does not do much, in future it can do more
  * of JNLP related stuff.
@@ -35,7 +34,6 @@ public class Main extends Object {
      * @throws Exception for lots of reasons
      */
     public static void main (String args[]) throws Exception {
-        fixPolicy();
         fixNetBeansUser();
         org.netbeans.Main.main(args);
     }
@@ -62,21 +60,4 @@ static final void fixNetBeansUser() {
             userDir.substring(uh + PREFIX.length()); 
         System.setProperty("netbeans.user", newDir); // NOI18N
     }
-    
-    /**
-     * Attempt to give the rest of NetBeans all the
-     * permissions. The jars besides the one containing this class
-     * don't have to be signed with this.
-     */
-    static final void fixPolicy() {
-        if (Boolean.getBoolean("netbeans.jnlp.fixPolicy")) { // NOI18N
-            // Grant all the code all persmission
-            Policy.setPolicy(new RuntimePolicy());
-            // Replace the security manager by a fresh copy
-            // that does the delegation to the permissions system
-            // -- just to make sure that there is nothing left
-            //    from the JWS
-            System.setSecurityManager(new SecurityManager());
-        }
-    }
 }
diff --git a/harness/apisupport.harness/release/jnlp.xml b/harness/apisupport.harness/release/jnlp.xml
index cd1251a27927..98418cdd36a8 100644
--- a/harness/apisupport.harness/release/jnlp.xml
+++ b/harness/apisupport.harness/release/jnlp.xml
@@ -44,8 +44,6 @@
   </information>
   <security><all-permissions/></security>
   <resources>
-    <!-- The following property is needed when running with unsigned jars: -->
-    <property name="netbeans.jnlp.fixPolicy" value="$${netbeans.jnlp.fixPolicy}"/>
     <extension name='branding' href='branding.jnlp' />
 <!-- The following line will be replaced with an automatically generated list of resources: -->
 <!--$${jnlp.resources}-->
@@ -304,14 +302,6 @@
         
         <loadfile property="jnlp.resources" srcfile="${jnlp.master.dir}/resources.xml"/>
 
-        <condition property="netbeans.jnlp.fixPolicy">
-            <isfalse value="${jnlp.sign.jars}"/>
-        </condition>
-        <!-- Anyone knows a better way to negate a property value? -->
-        <condition property="netbeans.jnlp.fixPolicy" value="false">
-            <istrue value="${jnlp.sign.jars}"/>
-        </condition>
-        
         <condition property="app.icon.safe" value="${app.icon}" else=".png">
             <isset property="app.icon" />
         </condition>
@@ -330,7 +320,6 @@
                 <replacestring from="$${app.title}" to="${app.title}"/>
                 <replacestring from="$${app.icon}" to="master.${app.icon.ext}"/>
                 <replacestring from="$${branding.token}" to="${branding.token}"/>
-                <replacestring from="$${netbeans.jnlp.fixPolicy}" to="${netbeans.jnlp.fixPolicy}"/>
             </filterchain>
         </copy>
         <jnlpupdatemanifeststartup appname="${app.name}"
diff --git a/harness/apisupport.harness/test/unit/src/org/netbeans/modules/apisupport/jnlplauncher/FixPolicyTest.java b/harness/apisupport.harness/test/unit/src/org/netbeans/modules/apisupport/jnlplauncher/FixPolicyTest.java
deleted file mode 100644
index 465dae1f230f..000000000000
--- a/harness/apisupport.harness/test/unit/src/org/netbeans/modules/apisupport/jnlplauncher/FixPolicyTest.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.netbeans.modules.apisupport.jnlplauncher;
-
-import java.net.URL;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.CertificateException;
-import junit.framework.*;
-import java.security.*;
-
-/**
- * Test whether the system property netbeans.jnlp.fixPolicy
- * really grants everything to everybody.
- * @author David Strupl
- */
-public class FixPolicyTest extends TestCase {
-
-    private URL url = null;
-
-    public FixPolicyTest(String testName) {
-        super(testName);
-    }
-
-    public void testFixPolicy() throws Exception {
-
-        url = new URL("http://boo.baa");
-        System.setProperty("netbeans.jnlp.fixPolicy", "true");
-        
-        Main.fixPolicy();
-        
-        assertTrue(Policy.getPolicy().implies(
-            new ProtectionDomain(
-                new CodeSource(
-                    url,
-                    new java.security.cert.Certificate[0]
-                ),
-                new AllPermission().newPermissionCollection()),
-                new AllPermission()
-        ));
-    }
-
-}