src/java.base/share/classes/javax/security/auth/Subject.java

*** 152,166 ****
       * {@code AuthPermission("modifyPrivateCredentials")}.
       */
      public Subject() {
  
          this.principals = Collections.synchronizedSet
!                         (new SecureSet<Principal>(this, PRINCIPAL_SET));
          this.pubCredentials = Collections.synchronizedSet
!                         (new SecureSet<Object>(this, PUB_CREDENTIAL_SET));
          this.privCredentials = Collections.synchronizedSet
!                         (new SecureSet<Object>(this, PRIV_CREDENTIAL_SET));
      }
  
      /**
       * Create an instance of a {@code Subject} with
       * Principals and credentials.
--- 152,166 ----
       * {@code AuthPermission("modifyPrivateCredentials")}.
       */
      public Subject() {
  
          this.principals = Collections.synchronizedSet
!                         (new SecureSet<>(this, PRINCIPAL_SET));
          this.pubCredentials = Collections.synchronizedSet
!                         (new SecureSet<>(this, PUB_CREDENTIAL_SET));
          this.privCredentials = Collections.synchronizedSet
!                         (new SecureSet<>(this, PRIV_CREDENTIAL_SET));
      }
  
      /**
       * Create an instance of a {@code Subject} with
       * Principals and credentials.
*** 204,218 ****
      {
          collectionNullClean(principals);
          collectionNullClean(pubCredentials);
          collectionNullClean(privCredentials);
  
!         this.principals = Collections.synchronizedSet(new SecureSet<Principal>
                                  (this, PRINCIPAL_SET, principals));
!         this.pubCredentials = Collections.synchronizedSet(new SecureSet<Object>
                                  (this, PUB_CREDENTIAL_SET, pubCredentials));
!         this.privCredentials = Collections.synchronizedSet(new SecureSet<Object>
                                  (this, PRIV_CREDENTIAL_SET, privCredentials));
          this.readOnly = readOnly;
      }
  
      /**
--- 204,218 ----
      {
          collectionNullClean(principals);
          collectionNullClean(pubCredentials);
          collectionNullClean(privCredentials);
  
!         this.principals = Collections.synchronizedSet(new SecureSet<>
                                  (this, PRINCIPAL_SET, principals));
!         this.pubCredentials = Collections.synchronizedSet(new SecureSet<>
                                  (this, PUB_CREDENTIAL_SET, pubCredentials));
!         this.privCredentials = Collections.synchronizedSet(new SecureSet<>
                                  (this, PRIV_CREDENTIAL_SET, privCredentials));
          this.readOnly = readOnly;
      }
  
      /**
*** 290,300 ****
          Objects.requireNonNull(acc, ResourcesMgr.getString
                  ("invalid.null.AccessControlContext.provided"));
  
          // return the Subject from the DomainCombiner of the provided context
          return AccessController.doPrivileged
!             (new java.security.PrivilegedAction<Subject>() {
              public Subject run() {
                  DomainCombiner dc = acc.getDomainCombiner();
                  if (!(dc instanceof SubjectDomainCombiner)) {
                      return null;
                  }
--- 290,300 ----
          Objects.requireNonNull(acc, ResourcesMgr.getString
                  ("invalid.null.AccessControlContext.provided"));
  
          // return the Subject from the DomainCombiner of the provided context
          return AccessController.doPrivileged
!             (new java.security.PrivilegedAction<>() {
              public Subject run() {
                  DomainCombiner dc = acc.getDomainCombiner();
                  if (!(dc instanceof SubjectDomainCombiner)) {
                      return null;
                  }
*** 553,563 ****
      private static AccessControlContext createContext(final Subject subject,
                                          final AccessControlContext acc) {
  
  
          return java.security.AccessController.doPrivileged
!             (new java.security.PrivilegedAction<AccessControlContext>() {
              public AccessControlContext run() {
                  if (subject == null) {
                      return new AccessControlContext(acc, null);
                  } else {
                      return new AccessControlContext
--- 553,563 ----
      private static AccessControlContext createContext(final Subject subject,
                                          final AccessControlContext acc) {
  
  
          return java.security.AccessController.doPrivileged
!             (new java.security.PrivilegedAction<>() {
              public AccessControlContext run() {
                  if (subject == null) {
                      return new AccessControlContext(acc, null);
                  } else {
                      return new AccessControlContext
*** 799,827 ****
  
              // check the principal and credential sets
              Set<Principal> thatPrincipals;
              synchronized(that.principals) {
                  // avoid deadlock from dual locks
!                 thatPrincipals = new HashSet<Principal>(that.principals);
              }
              if (!principals.equals(thatPrincipals)) {
                  return false;
              }
  
              Set<Object> thatPubCredentials;
              synchronized(that.pubCredentials) {
                  // avoid deadlock from dual locks
!                 thatPubCredentials = new HashSet<Object>(that.pubCredentials);
              }
              if (!pubCredentials.equals(thatPubCredentials)) {
                  return false;
              }
  
              Set<Object> thatPrivCredentials;
              synchronized(that.privCredentials) {
                  // avoid deadlock from dual locks
!                 thatPrivCredentials = new HashSet<Object>(that.privCredentials);
              }
              if (!privCredentials.equals(thatPrivCredentials)) {
                  return false;
              }
              return true;
--- 799,827 ----
  
              // check the principal and credential sets
              Set<Principal> thatPrincipals;
              synchronized(that.principals) {
                  // avoid deadlock from dual locks
!                 thatPrincipals = new HashSet<>(that.principals);
              }
              if (!principals.equals(thatPrincipals)) {
                  return false;
              }
  
              Set<Object> thatPubCredentials;
              synchronized(that.pubCredentials) {
                  // avoid deadlock from dual locks
!                 thatPubCredentials = new HashSet<>(that.pubCredentials);
              }
              if (!pubCredentials.equals(thatPubCredentials)) {
                  return false;
              }
  
              Set<Object> thatPrivCredentials;
              synchronized(that.privCredentials) {
                  // avoid deadlock from dual locks
!                 thatPrivCredentials = new HashSet<>(that.privCredentials);
              }
              if (!privCredentials.equals(thatPrivCredentials)) {
                  return false;
              }
              return true;
*** 968,992 ****
          Objects.requireNonNull(inputPrincs,
                  ResourcesMgr.getString("invalid.null.input.s."));
  
          // Rewrap the principals into a SecureSet
          try {
!             principals = Collections.synchronizedSet(new SecureSet<Principal>
                                  (this, PRINCIPAL_SET, inputPrincs));
          } catch (NullPointerException npe) {
              // Sometimes people deserialize the principals set only.
              // Subject is not accessible, so just don't fail.
              principals = Collections.synchronizedSet
!                         (new SecureSet<Principal>(this, PRINCIPAL_SET));
          }
  
          // The Credential {@code Set} is not serialized, but we do not
          // want the default deserialization routine to set it to null.
          this.pubCredentials = Collections.synchronizedSet
!                         (new SecureSet<Object>(this, PUB_CREDENTIAL_SET));
          this.privCredentials = Collections.synchronizedSet
!                         (new SecureSet<Object>(this, PRIV_CREDENTIAL_SET));
      }
  
      /**
       * Tests for null-clean collections (both non-null reference and
       * no null elements)
--- 968,992 ----
          Objects.requireNonNull(inputPrincs,
                  ResourcesMgr.getString("invalid.null.input.s."));
  
          // Rewrap the principals into a SecureSet
          try {
!             principals = Collections.synchronizedSet(new SecureSet<>
                                  (this, PRINCIPAL_SET, inputPrincs));
          } catch (NullPointerException npe) {
              // Sometimes people deserialize the principals set only.
              // Subject is not accessible, so just don't fail.
              principals = Collections.synchronizedSet
!                         (new SecureSet<>(this, PRINCIPAL_SET));
          }
  
          // The Credential {@code Set} is not serialized, but we do not
          // want the default deserialization routine to set it to null.
          this.pubCredentials = Collections.synchronizedSet
!                         (new SecureSet<>(this, PUB_CREDENTIAL_SET));
          this.privCredentials = Collections.synchronizedSet
!                         (new SecureSet<>(this, PRIV_CREDENTIAL_SET));
      }
  
      /**
       * Tests for null-clean collections (both non-null reference and
       * no null elements)
*** 1495,1505 ****
  
              while (iterator.hasNext()) {
                  Object next;
                  if (which == Subject.PRIV_CREDENTIAL_SET) {
                      next = java.security.AccessController.doPrivileged
!                         (new java.security.PrivilegedAction<Object>() {
                          public Object run() {
                              return iterator.next();
                          }
                      });
                  } else {
--- 1495,1505 ----
  
              while (iterator.hasNext()) {
                  Object next;
                  if (which == Subject.PRIV_CREDENTIAL_SET) {
                      next = java.security.AccessController.doPrivileged
!                         (new java.security.PrivilegedAction<>() {
                          public Object run() {
                              return iterator.next();
                          }
                      });
                  } else {