src/java.base/share/classes/sun/security/provider/PolicyFile.java

@@ -75,11 +75,11 @@
  *   <i>policy.url.1</i>, <i>policy.url.2</i>, ...,
  *   <i>policy.url.X</i>" and
  *   <i>auth.policy.url.1</i>, <i>auth.policy.url.2</i>, ...,
  *   <i>auth.policy.url.X</i>".  These properties are set
  *   in the Java security properties file, which is located in the file named
- *   &lt;JAVA_HOME&gt;/lib/security/java.security.
+ *   &lt;JAVA_HOME&gt;/conf/security/java.security.
  *   &lt;JAVA_HOME&gt; refers to the value of the java.home system property,
  *   and specifies the directory where the JRE is installed.
  *   Each property value specifies a <code>URL</code> pointing to a
  *   policy file to be loaded.  Read in and load each policy.
  *

@@ -316,11 +316,11 @@
      *   loop through the Security Properties named "policy.url.1",
      *  ""policy.url.2", "auth.policy.url.1",  "auth.policy.url.2" etc, until
      *   you don't find one. Each of these specify a policy file.
      *
      *   if none of these could be loaded, use a builtin static policy
-     *      equivalent to the default lib/security/java.policy file.
+     *      equivalent to the default conf/security/java.policy file.
      *
      *   if the system property "java.policy" or "java.auth.policy" is defined
      * (which is the
      *      case when the user uses the -D switch at runtime), and
      *     its use is allowed by the security property file,

@@ -466,11 +466,11 @@
 
             /**
              * Caller did not specify URL via Policy.getInstance.
              * Read from URLs listed in the java.security properties file.
              *
-             * We call initPolicyFile with POLICY , POLICY_URL and then
+             * We call initPolicyFile with POLICY, POLICY_URL and then
              * call it with AUTH_POLICY and AUTH_POLICY_URL
              * So first we will process the JAVA standard policy
              * and then process the JAVA AUTH Policy.
              * This is for backward compatibility as well as to handle
              * cases where the user has a single unified policyfile

@@ -707,30 +707,10 @@
                     SecurityConstants.PROPERTY_READ_ACTION));
 
                 // No need to sync because noone has access to newInfo yet
                 newInfo.policyEntries.add(pe);
 
-                // Add AllPermissions for standard extensions
-                String[] extCodebases = PolicyParser.parseExtDirs(
-                    PolicyParser.EXTDIRS_EXPANSION, 0);
-                if (extCodebases != null && extCodebases.length > 0) {
-                    for (int i = 0; i < extCodebases.length; i++) {
-                        try {
-                            pe = new PolicyEntry(canonicalizeCodebase(
-                                new CodeSource(new URL(extCodebases[i]),
-                                    (Certificate[]) null), false ));
-                            pe.add(SecurityConstants.ALL_PERMISSION);
-
-                            // No need to sync because noone has access to
-                            // newInfo yet
-                            newInfo.policyEntries.add(pe);
-                        } catch (Exception e) {
-                            // this is probably bad (though not dangerous).
-                            // What should we do?
-                        }
-                    }
-                }
                 return null;
             }
         });
     }