JDK-8198810 : URLClassLoader does not specify behavior when URL array contains null
  • Type: CSR
  • Component: core-libs
  • Sub-Component: java.net
  • Priority: P2
  • Status: Closed
  • Resolution: Approved
  • Fix Versions: 11
  • Submitted: 2018-02-28
  • Updated: 2022-08-23
  • Resolved: 2018-03-01
Related Reports
CSR :  
Description
Summary
-------

URLClassLoader should reject null URLs in constructor arguments.

Problem
-------

URLClassLoader's constructors do not specify if the URL array specified to the constructor can include a `null` element. The historical behavior was unpredictable in that it allowed the class loader to be created with a `null` URL.

Solution
--------

Specify that nulls are rejected where appropriate.

Specification
-------------

```
--- a/src/java.base/share/classes/java/net/URLClassLoader.java
+++ b/src/java.base/share/classes/java/net/URLClassLoader.java
@@ -105,7 +105,8 @@
      * @exception  SecurityException  if a security manager exists and its
      *             {@code checkCreateClassLoader} method doesn't allow
      *             creation of a class loader.
-     * @exception  NullPointerException if {@code urls} is {@code null}.
+     * @exception  NullPointerException if {@code urls} or any of its
+     *             elements is {@code null}.
      * @see SecurityManager#checkCreateClassLoader
      */
     public URLClassLoader(URL[] urls, ClassLoader parent) {
@@ -149,7 +150,8 @@
      * @exception  SecurityException  if a security manager exists and its
      *             {@code checkCreateClassLoader} method doesn't allow
      *             creation of a class loader.
-     * @exception  NullPointerException if {@code urls} is {@code null}.
+     * @exception  NullPointerException if {@code urls} or any of its
+     *             elements is {@code null}.
      * @see SecurityManager#checkCreateClassLoader
      */
     public URLClassLoader(URL[] urls) {
@@ -192,7 +194,8 @@
      * @exception  SecurityException  if a security manager exists and its
      *             {@code checkCreateClassLoader} method doesn't allow
      *             creation of a class loader.
-     * @exception  NullPointerException if {@code urls} is {@code null}.
+     * @exception  NullPointerException if {@code urls} or any of its
+     *             elements is {@code null}.
      * @see SecurityManager#checkCreateClassLoader
      */
     public URLClassLoader(URL[] urls, ClassLoader parent,
@@ -221,7 +224,8 @@
      * @param  parent the parent class loader for delegation
      *
      * @throws IllegalArgumentException if the given name is empty.
-     * @throws NullPointerException if {@code urls} is {@code null}.
+     * @throws NullPointerException if {@code urls} or any of its
+     *         elements is {@code null}.
      *
      * @throws SecurityException if a security manager exists and its
      *         {@link SecurityManager#checkCreateClassLoader()} method doesn't
@@ -256,7 +260,8 @@
      * @param  factory the URLStreamHandlerFactory to use when creating URLs
      *
      * @throws IllegalArgumentException if the given name is empty.
-     * @throws NullPointerException if {@code urls} is {@code null}.
+     * @throws NullPointerException if {@code urls} or any of its
+     *         elements is {@code null}.
      *
      * @throws SecurityException if a security manager exists and its
      *         {@code checkCreateClassLoader} method doesn't allow
@@ -805,7 +810,8 @@
      *
      * @param urls the URLs to search for classes and resources
      * @param parent the parent class loader for delegation
-     * @exception  NullPointerException if {@code urls} is {@code null}.
+     * @exception  NullPointerException if {@code urls} or any of its
+     *             elements is {@code null}.
      * @return the resulting class loader
      */
     public static URLClassLoader newInstance(final URL[] urls,
@@ -831,7 +837,8 @@
      * loading the class.
      *
      * @param urls the URLs to search for classes and resources
-     * @exception  NullPointerException if {@code urls} is {@code null}.
+     * @exception  NullPointerException if {@code urls} or any of its
+     *             elements is {@code null}.
      * @return the resulting class loader
      */
     public static URLClassLoader newInstance(final URL[] urls) {
```
Comments
Agree that a release note is needed; moving to Approved.
01-03-2018

The historical behaviour was unpredictable so the proposed change make sense for a feature release. It will require a release note.
28-02-2018