Merge pull request #203 from javaevolved/brunoborges-securitymanager-explicit-authorization

Add SecurityManager explicit authorization pattern

Author: brunoborges

.github/ISSUE_TEMPLATE/new-pattern.yml

@@ -9,9 +9,17 @@ body:
       value: |
         ## How to submit a new pattern
 
-        Patterns are defined as **JSON files** in category subfolders.
-        Please provide the information below and we'll create the JSON file,
-        or submit a PR with the JSON file directly.
+        Patterns are defined as **YAML files** in category subfolders.
+        Please provide the information below and we'll create the pattern,
+        or submit a pull request that completes this checklist:
+
+        - Canonical content with valid metadata, tags, related patterns, and reciprocal navigation
+        - A Java 25 proof for the modern code
+        - Partial content translations for every locale in `html-generators/locales.properties`
+        - Successful regeneration of all localized site output
+        - An appended social queue entry and pre-drafted tweet
+
+        Pull requests validate this checklist automatically.
 
   - type: dropdown
     id: category

.github/copilot-instructions.md

@@ -62,8 +62,10 @@ Content files are YAML (preferred) or JSON under `content/{category}/{slug}.yaml
 2. Add a non-empty `tags` list. Every tag slug must already exist in `html-generators/tags.properties`; add new `slug=Display Name` entries there in the same change.
 3. Update `prev`/`next` in the adjacent patterns to maintain the navigation chain.
 4. Create `proof/{category}/{PascalCaseSlug}.java` — JBang script wrapping the modern code.
-5. Run `jbang html-generators/generate.java` and verify it completes. The generator rejects missing, malformed, or duplicate UUIDs as well as missing, empty, malformed, and unregistered tags.
-6. Translations are optional — the AI translation workflow handles them, or create partial files under `translations/content/{locale}/`.
+5. Create a partial translation at `translations/content/{locale}/{category}/{slug}.yaml` for every non-English locale registered in `html-generators/locales.properties`.
+6. Run `jbang html-generators/generate.java` and verify all localized output builds. Generated site files are ignored and must not be committed. The generator rejects missing, malformed, or duplicate UUIDs as well as missing, empty, malformed, and unregistered tags.
+7. Run `jbang html-generators/generatesocialqueue.java` without `--reshuffle`. Commit the appended `social/queue.txt` entry and `social/tweets.yaml` draft; do not change `social/state.yaml`.
+8. Run `jbang html-generators/validatepatternchanges.java --file content/{category}/{slug}.yaml` and the new proof. The validator enforces translations, proof, navigation, related targets, and social artifacts.
 
 ### Removing or reordering a pattern
 

.github/workflows/content-validation.yml

@@ -5,9 +5,13 @@ on:
     paths:
       - '.github/workflows/content-validation.yml'
       - 'content/**'
+      - 'proof/**'
+      - 'social/queue.txt'
+      - 'social/tweets.yaml'
       - 'translations/**'
       - 'templates/**'
       - 'html-generators/generate.java'
+      - 'html-generators/validatepatternchanges.java'
       - 'html-generators/tags.properties'
       - 'html-generators/categories.properties'
       - 'html-generators/locales.properties'
@@ -21,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-java@v6
         with:
@@ -29,5 +35,12 @@ jobs:
 
       - uses: jbangdev/setup-jbang@main
 
+      - name: Validate new pattern checklist
+        if: github.event_name == 'pull_request'
+        run: >
+          jbang html-generators/validatepatternchanges.java
+          --base "${{ github.event.pull_request.base.sha }}"
+          --head "${{ github.event.pull_request.head.sha }}"
+
       - name: Validate content and generate site
         run: jbang html-generators/generate.java

content/security/random-generator.yaml

@@ -45,7 +45,7 @@ support:
   state: "available"
   description: "Available since JDK 17 (September 2021, JEP 356)."
 prev: "security/tls-default"
-next: "tooling/jshell-prototyping"
+next: "security/security-manager-migration"
 related:
 - "security/strong-random"
 - "security/key-derivation-functions"

content/security/security-manager-migration.yaml

@@ -0,0 +1,66 @@
+---
+id: 9e0d265f-d778-4115-9fc9-b09e37c55e41
+slug: "security-manager-migration"
+title: "SecurityManager checks to explicit authorization"
+category: "security"
+difficulty: "advanced"
+jdkVersion: "24"
+oldLabel: "JDK 23 and earlier"
+modernLabel: "JDK 24+"
+oldApproach: "SecurityManager checks"
+modernApproach: "Explicit authorization"
+oldCode: |-
+  SecurityManager manager = System.getSecurityManager();
+  if (manager != null) {
+      manager.checkRead(path.toString());
+  }
+  return Files.readString(path);
+modernCode: |-
+  // Untrusted users must not be able to modify this tree
+  Path root = allowedRoot.toRealPath();
+  Path resolved = root.resolve(requested)
+      .normalize()
+      .toRealPath();
+  if (!resolved.startsWith(root)) {
+      throw new SecurityException(
+          "Path is outside the allowed root");
+  }
+  return Files.readString(resolved);
+summary: "Replace disabled SecurityManager checks with explicit application authorization\
+  \ and deployment isolation."
+explanation: "JEP 486 permanently disabled the Security Manager in JDK 24, so checks\
+  \ through System.getSecurityManager() can enforce policy only on JDK 23 and earlier.\
+  \ Applications must authorize access explicitly in domain logic; resolving real filesystem\
+  \ paths prevents existing symbolic links from escaping an allowed root when untrusted\
+  \ users cannot modify that tree concurrently. For attacker-writable trees, use race-resistant,\
+  \ handle-relative access such as SecureDirectoryStream. Use process, container, or\
+  \ operating-system boundaries for isolation. JDK 24 retains the deprecated API temporarily,\
+  \ but it cannot be enabled and is not replaced by another in-process sandbox."
+whyModernWins:
+- icon: "🔍"
+  title: "Explicit policy"
+  desc: "Authorization is visible and testable in application logic."
+- icon: "🛡️"
+  title: "Real isolation"
+  desc: "Process, container, and operating-system boundaries protect the whole application."
+- icon: "🚫"
+  title: "Required migration"
+  desc: "Removes checks that can no longer enforce policy on JDK 24 and later."
+support:
+  state: "available"
+  description: "Required on JDK 24 and later, where JEP 486 permanently disables the\
+    \ Security Manager."
+prev: "security/random-generator"
+next: "tooling/jshell-prototyping"
+related:
+- "io/reading-files"
+- "io/deserialization-filters"
+- "security/tls-default"
+tags:
+- security
+- migration
+docs:
+- title: "Permanently Disable the Security Manager (JEP 486)"
+  href: "https://openjdk.org/jeps/486"
+- title: "SecureDirectoryStream"
+  href: "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/nio/file/SecureDirectoryStream.html"

content/tooling/jshell-prototyping.yaml

@@ -37,7 +37,7 @@ whyModernWins:
 support:
   state: "available"
   description: "Widely available since JDK 9 (Sept 2017)"
-prev: "security/tls-default"
+prev: "security/security-manager-migration"
 next: "tooling/single-file-execution"
 related:
 - "tooling/aot-class-preloading"