JDK-4953367 : MAWT: Java should be more careful manipulating NLSPATH, XFILESEARCHPATH env variables
  • Type: Bug
  • Component: client-libs
  • Sub-Component: java.awt
  • Affected Version: 6
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux
  • CPU: generic
  • Submitted: 2003-11-13
  • Updated: 2017-11-29
  • Resolved: 2015-09-17
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u152Fixed 9 b83Fixed
Related Reports
Relates :  
Description
This code in java/lang/java_props_md.c:

     /* Append CDE message and resource search path to NLSPATH and
      * XFILESEARCHPATH, in order to pick localized message for 
      * FileSelectionDialog window (Bug 4173641).
      */
     setPathEnvironment("NLSPATH=/usr/dt/lib/nls/msg/%L/%N.cat");
     setPathEnvironment("XFILESEARCHPATH=/usr/dt/app-defaults/%L/Dt");

unilaterally modifies environment variables that the user expects to
see unmodified.  Furthermore, it sets them to values that may be
clearly incorrect (for example, if CDE is not installed, and there
is no /usr/dt).

It is likely there is some mechanism other than the "quick hack"
of the current code to affect the search path for resources that
both respect the user settings and avoid modification of the user's
environment.

Even if those environment variables are set in the current process, they
should not be propagated to child processes.   While writing my own
test cases for java.lang.ProcessBuilder, I noticed that these extra
magic environment variables were being created and had to special-case
them.  

The Blackdown group was sufficiently annoyed by these that they did:

+#ifndef __linux__
     /* Append CDE message and resource search path to NLSPATH and
      * XFILESEARCHPATH, in order to pick localized message for 
      * FileSelectionDialog window (Bug 4173641).
      */
     setPathEnvironment("NLSPATH=/usr/dt/lib/nls/msg/%L/%N.cat");
     setPathEnvironment("XFILESEARCHPATH=/usr/dt/app-defaults/%L/Dt");
+#endif
 
This fix is the path of least resistance.  Linux users are unlikely to
be using CDE.

If we do decide to modify the environment, and the selected variables
are undefined, then they should not be unilaterally set to the values above,
but to the concatenation of the default value for
that particular operating system and the value above.  This is a subtle
semantic difference.

###@###.### 2003-11-12

Comments
There appears to be consensus that we can get rid of the dangerous modification of these environment variables entirely. The new information that putenv can cause a crash makes fixing this essential.
16-09-2015

As I said over in https://bugs.openjdk.java.net/browse/JDK-8136570 """putenv is fundamentally thread-unsafe! We have observed crashes in getenv probably caused by concurrent putenv, and the assignments to XFILESEARCHPATH and NLSPATH for /usr/dt (CDE?) are the most likely suspects. They are the only environment variables modified running HelloWorld on Linux. """ The current code is fundamentally crash-prone, because there is no guarantee that some other thread is not currently calling getenv. The crashes are naturally very rare - most java programs access the environment very rarely, especially during JVM startup.
15-09-2015

EVALUATION XAWT is default on Solaris in 6.0, and I do not think we are going to fix this problem in MAWT (unless someone escalate it)
15-02-2007

CONVERTED DATA BugTraq+ Release Management Values COMMIT TO FIX: mustang
14-08-2004

WORK AROUND Users can explicitly define NLSPATH and XFILESEARCHPATH, perhaps to the operating system's default value, allowing the default value to override the value known to J2SE. ###@###.### 2003-11-12
12-11-2003

EVALUATION We haven't had any customer complaints about this, and it will be resolved by XAWT anyway. We'll plan to fix this by switching XAWT to be default in mustang. ###@###.### 2003-11-12
12-11-2003