# HG changeset patch
# User okutsu
# Date 1319097356 -32400
# Node ID c90dba86a584684ceee037abce350ce66a0d87d9
# Parent  1d04b88d06f233fd4edead67e73da384eaa5c420
6351654: (tz) java.util.TimeZone.setDefault() should be controlled by a security manager
Reviewed-by: hawtin

diff -r 1d04b88d06f2 -r c90dba86a584 src/share/classes/java/util/TimeZone.java
--- a/src/share/classes/java/util/TimeZone.java	Fri Dec 02 10:44:11 2011 +0400
+++ b/src/share/classes/java/util/TimeZone.java	Thu Oct 20 16:55:56 2011 +0900
@@ -43,6 +43,7 @@
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.concurrent.ConcurrentHashMap;
+import sun.awt.AppContext;
 import sun.security.action.GetPropertyAction;
 import sun.util.TimeZoneNameUtility;
 import sun.util.calendar.ZoneInfo;
@@ -615,7 +616,7 @@
      * method doesn't create a clone.
      */
     static TimeZone getDefaultRef() {
-        TimeZone defaultZone = defaultZoneTL.get();
+        TimeZone defaultZone = getDefaultInAppContext();
         if (defaultZone == null) {
             defaultZone = defaultTimeZone;
             if (defaultZone == null) {
@@ -706,10 +707,49 @@
         if (hasPermission()) {
             synchronized (TimeZone.class) {
                 defaultTimeZone = zone;
-                defaultZoneTL.set(null);
+                setDefaultInAppContext(null);
             }
         } else {
-            defaultZoneTL.set(zone);
+            setDefaultInAppContext(zone);
+        }
+    }
+
+    /**
+     * Returns the default TimeZone in an AppContext if any AppContext
+     * has ever used. null is returned if any AppContext hasn't been
+     * used or if the AppContext doesn't have the default TimeZone.
+     */
+    private synchronized static TimeZone getDefaultInAppContext() {
+        if (!hasSetInAppContext) {
+            return null;
+        }
+
+        AppContext ac = AppContext.getAppContext();
+        if (ac != null && !ac.isDisposed()) {
+            return (TimeZone) ac.get(TimeZone.class);
+        }
+        return null;
+    }
+
+    /**
+     * Sets the default TimeZone in the AppContext to the given
+     * tz. null is handled special: do nothing if any AppContext
+     * hasn't been used, remove the default TimeZone in the
+     * AppContext otherwise.
+     */
+    private synchronized static void setDefaultInAppContext(TimeZone tz) {
+        if (!hasSetInAppContext && tz == null) {
+            return;
+        }
+
+        AppContext ac = AppContext.getAppContext();
+        if (ac != null && !ac.isDisposed()) {
+            if (tz != null) {
+                ac.put(TimeZone.class, tz);
+                hasSetInAppContext = true;
+            } else {
+                ac.remove(TimeZone.class);
+            }
         }
     }
 
@@ -760,12 +800,13 @@
      */
     private String           ID;
     private static volatile TimeZone defaultTimeZone;
-    private static final InheritableThreadLocal<TimeZone> defaultZoneTL
-                                        = new InheritableThreadLocal<TimeZone>();
 
     static final String         GMT_ID        = "GMT";
     private static final int    GMT_ID_LENGTH = 3;
 
+    // true if the default TimeZone has been set in any AppContext
+    private static boolean hasSetInAppContext;
+
     /**
      * Parses a custom time zone identifier and returns a corresponding zone.
      * This method doesn't support the RFC 822 time zone format. (e.g., +hhmm)