From 2fbc27414e67561f909feb4147dfd65cd508ebf0 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Sun, 27 Dec 2015 23:43:06 +0100
Subject: [PATCH 01/14] First stab on rewriting internalRuntimeForbidden
 heuristics to be reliable without static signature file: - On Java 9 (w/wo
 Jigsaw) check module system for runtime class (module name starts with
 "java." or "jdk.") - Invert the package pattern: Only list packages in
 official Java documentation (java.*, javax.* and few others extracted from
 Javadocs) - Start to rename the setting: internalRuntimeForbidden ->
 nonPortableRuntimeForbidden

---
 .../de/thetaphi/forbiddenapis/AsmUtils.java   | 49 ++++++++++++++++---
 .../de/thetaphi/forbiddenapis/Checker.java    | 43 ++++++++++------
 .../thetaphi/forbiddenapis/ClassScanner.java  | 24 +++++----
 .../signatures/jdk-deprecated-1.7.txt         |  2 +-
 .../signatures/jdk-deprecated-1.8.txt         |  5 +-
 src/test/antunit/TestInternalRuntimeCalls.xml |  2 +-
 .../thetaphi/forbiddenapis/AsmUtilsTest.java  | 29 ++++++++---
 .../thetaphi/forbiddenapis/DeprecatedGen.java |  2 +-
 8 files changed, 109 insertions(+), 47 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
index 3ceeb826..b2487b20 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
@@ -16,6 +16,7 @@
  * limitations under the License.
  */
 
+import java.net.URL;
 import java.util.Arrays;
 import java.util.Locale;
 import java.util.regex.Pattern;
@@ -26,24 +27,44 @@ public final class AsmUtils {
   private AsmUtils() {}
   
   private static final String REGEX_META_CHARS = ".^$+{}[]|()\\";
-  private static final Pattern INTERNAL_PACKAGE_PATTERN;
-  static {
+  
+  /** Package prefixes of documented Java API (extracted from Javadocs of Java 8). */
+  private static final Pattern PORTABLE_RUNTIME_PACKAGE_PATTERN = makePkgPrefixPattern("java", "javax", "org.ietf.jgss", "org.omg", "org.w3c.dom", "org.xml.sax");
+  
+  /** Pattern that matches all module names, which are shipped by default in Java.
+   * (see: {@code http://openjdk.java.net/projects/jigsaw/spec/sotms/}):
+   * The remaining platform modules will share the 'java.' name prefix and are likely to include,
+   * e.g., java.sql for database connectivity, java.xml for XML processing, and java.logging for
+   * logging. Modules that are not defined in the Java SE 9 Platform Specification but instead
+   * specific to the JDK will, by convention, share the 'jdk.' name prefix.
+   */
+  private static final Pattern RUNTIME_MODULES_PATTERN = makePkgPrefixPattern("java", "jdk");
+  
+  private static Pattern makePkgPrefixPattern(String... prefixes) {
     final StringBuilder sb = new StringBuilder();
     boolean first = true;
-    for (final String pkg : Arrays.asList("sun.", "oracle.", "com.sun.", "com.oracle.", "jdk.", "sunw.")) {
+    for (final String pkg : Arrays.asList(prefixes)) {
       sb.append(first ? '(' : '|').append(Pattern.quote(pkg));
       first = false;
     }
-    INTERNAL_PACKAGE_PATTERN = Pattern.compile(sb.append(").*").toString());
+    sb.append(")").append(Pattern.quote(".")).append(".*");
+    return Pattern.compile(sb.toString());
   }
   
   private static boolean isRegexMeta(char c) {
     return REGEX_META_CHARS.indexOf(c) != -1;
   }
 
-  /** Returns true, if the given binary class name (dotted) is likely a internal class (like sun.misc.Unsafe) */
-  public static boolean isInternalClass(String className) {
-    return INTERNAL_PACKAGE_PATTERN.matcher(className).matches();
+  /** Returns true, if the given binary class name (dotted) is part of the documented and portable Java APIs. */
+  public static boolean isPortableRuntimeClass(String className) {
+    return PORTABLE_RUNTIME_PACKAGE_PATTERN.matcher(className).matches();
+  }
+  
+  /** Returns true, if the given Java 9 module name is part of the runtime (no custom 3rd party module).
+   * @param module the module name or {@code null}, if in unnamed module
+   */
+  public static boolean isRuntimeModule(String module) {
+    return module != null && RUNTIME_MODULES_PATTERN.matcher(module).matches();
   }
   
   /** Converts a binary class name (dotted) to the JVM internal one (slashed). Only accepts valid class names, no arrays. */
@@ -103,5 +124,19 @@ public static Pattern glob2Pattern(String... globs) {
     }
     return Pattern.compile(regex.toString(), 0);
   }
+  
+  /** Returns the module name from a {@code jrt:/} URL. */
+  public static String getModuleName(URL jrtUrl) {
+    String mod = jrtUrl.getPath();
+    if (mod != null) {
+      mod = mod.substring(1);
+      int p = mod.indexOf('/');
+      if (p >= 0) {
+        mod = mod.substring(0, p);
+      }
+      return mod.isEmpty() ? null : mod;
+    }
+    return null;
+  }
 
 }
diff --git a/src/main/java/de/thetaphi/forbiddenapis/Checker.java b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
index bb76230a..040ba31a 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/Checker.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
@@ -72,7 +72,7 @@ public static enum Option {
   final NavigableSet<String> runtimePaths;
   
   final ClassLoader loader;
-  final java.lang.reflect.Method method_Class_getModule, method_Module_getResourceAsStream;
+  final java.lang.reflect.Method method_Class_getModule, method_Module_getResourceAsStream, method_Module_getName;
   final EnumSet<Option> options;
   
   // key is the binary name (dotted):
@@ -129,19 +129,22 @@ public Checker(Logger logger, ClassLoader loader, EnumSet<Option> options) {
     
     boolean isSupportedJDK = false;
     
-    // first try Java 9 mdoule system (Jigsaw)
+    // first try Java 9 module system (Jigsaw)
     // Please note: This code is not guaranteed to work with final Java 9 version. This is just for testing!
-    java.lang.reflect.Method method_Class_getModule, method_Module_getResourceAsStream;
+    java.lang.reflect.Method method_Class_getModule, method_Module_getResourceAsStream, method_Module_getName;
     try {
       method_Class_getModule = Class.class.getMethod("getModule");
       method_Module_getResourceAsStream = method_Class_getModule
           .getReturnType().getMethod("getResourceAsStream", String.class);
+      method_Module_getName = method_Class_getModule
+          .getReturnType().getMethod("getName");
       isSupportedJDK = true;
     } catch (NoSuchMethodException e) {
-      method_Class_getModule = method_Module_getResourceAsStream = null;
+      method_Class_getModule = method_Module_getResourceAsStream = method_Module_getName = null;
     }
     this.method_Class_getModule = method_Class_getModule;
     this.method_Module_getResourceAsStream = method_Module_getResourceAsStream;
+    this.method_Module_getName = method_Module_getName;
     
     final NavigableSet<String> runtimePaths = new TreeSet<String>();
     
@@ -222,17 +225,30 @@ public Checker(Logger logger, ClassLoader loader, EnumSet<Option> options) {
    * This code is not guaranteed to work with final Java 9 version.
    * This is just for testing!
    **/
-  private InputStream getBytecodeFromJigsaw(String classname) {
-    if (method_Class_getModule == null || method_Module_getResourceAsStream == null) {
+  private ClassSignature loadClassFromJigsaw(String classname) throws IOException {
+    if (method_Class_getModule == null || method_Module_getResourceAsStream == null || method_Module_getName == null) {
       return null; // not Java 9 JIGSAW
     }
+    
+    final InputStream in;
+    final String moduleName;
     try {
       final Class<?> clazz = Class.forName(classname, false, loader);
       final Object module = method_Class_getModule.invoke(clazz);
-      return (InputStream) method_Module_getResourceAsStream.invoke(module, AsmUtils.getClassResourceName(classname));
+      moduleName = (String) method_Module_getName.invoke(module);
+      in = (InputStream) method_Module_getResourceAsStream.invoke(module, AsmUtils.getClassResourceName(classname));
+      if (in == null) {
+        return null;
+      }
     } catch (Exception e) {
       return null; // not found
     }
+    
+    try {
+      return new ClassSignature(new ClassReader(in), AsmUtils.isRuntimeModule(moduleName), false);
+    } finally {
+      in.close();
+    }
   }
   
   private boolean isRuntimePath(URL url) throws IOException {
@@ -260,7 +276,7 @@ private boolean isRuntimeClass(URLConnection conn) throws IOException {
       // all 'jrt:' URLs refer to a module in the Java 9+ runtime (see http://openjdk.java.net/jeps/220)
       // This may still be different with module system. We support both variants for now.
       // Please note: This code is not guaranteed to work with final Java 9 version. This is just for testing!
-      return true;
+      return AsmUtils.isRuntimeModule(AsmUtils.getModuleName(url));
     }
     return false;
   }
@@ -287,14 +303,9 @@ private ClassSignature getClassFromClassLoader(final String clazz) throws ClassN
         }
         return c;
       } else {
-        final InputStream in = getBytecodeFromJigsaw(clazz);
-        if (in != null) {
-          try {
-            // we mark it as runtime class because it was derived from the module system:
-            classpathClassCache.put(clazz, c = new ClassSignature(new ClassReader(in), true, false));
-          } finally {
-            in.close();
-          }
+        final ClassSignature jigsawCl = loadClassFromJigsaw(clazz);
+        if (jigsawCl != null) {
+          classpathClassCache.put(clazz, c = jigsawCl);
           return c;
         }
       }
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java b/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
index 1b31b1bf..73d16044 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
@@ -46,7 +46,7 @@ final class ClassScanner extends ClassVisitor {
   static final String LAMBDA_META_FACTORY_INTERNALNAME = "java/lang/invoke/LambdaMetafactory";
   static final String LAMBDA_METHOD_NAME_PREFIX = "lambda$";
 
-  private final boolean internalRuntimeForbidden;
+  private final boolean forbidNonPortableRuntime;
   final RelatedClassLookup lookup;
   final List<ForbiddenViolation> violations = new ArrayList<ForbiddenViolation>();
   
@@ -70,7 +70,7 @@ final class ClassScanner extends ClassVisitor {
   // Mapping from a (possible) lambda Method to groupId of declaring method
   final Map<Method,Integer> lambdas = new HashMap<Method,Integer>();
   
-  // all groups that were disabled due to supressing annotation
+  // all groups that were disabled due to suppressing annotation
   final BitSet suppressedGroups = new BitSet();
   boolean classSuppressed = false;
   
@@ -78,7 +78,7 @@ public ClassScanner(RelatedClassLookup lookup,
       final Map<String,String> forbiddenClasses, final Iterable<ClassPatternRule> forbiddenClassPatterns,
       final Map<String,String> forbiddenMethods, final Map<String,String> forbiddenFields,
       final Pattern suppressAnnotations,
-      final boolean internalRuntimeForbidden) {
+      final boolean forbidNonPortableRuntime) {
     super(Opcodes.ASM5);
     this.lookup = lookup;
     this.forbiddenClasses = forbiddenClasses;
@@ -86,7 +86,7 @@ public ClassScanner(RelatedClassLookup lookup,
     this.forbiddenMethods = forbiddenMethods;
     this.forbiddenFields = forbiddenFields;
     this.suppressAnnotations = suppressAnnotations;
-    this.internalRuntimeForbidden = internalRuntimeForbidden;
+    this.forbidNonPortableRuntime = forbidNonPortableRuntime;
   }
   
   private void checkDone() {
@@ -122,15 +122,13 @@ String checkClassUse(Type type, String what, boolean deep) {
         return String.format(Locale.ENGLISH, "Forbidden %s use: %s", what, r.printout);
       }
     }
-    if (deep && internalRuntimeForbidden) {
-      if (AsmUtils.isInternalClass(binaryClassName)) {
-        final ClassSignature c = lookup.lookupRelatedClass(internalName);
-        if (c == null || c.isRuntimeClass) {
-          return String.format(Locale.ENGLISH,
-            "Forbidden %s use: %s [non-public internal runtime class]",
-            what, binaryClassName
-          );
-        }
+    if (deep && forbidNonPortableRuntime) {
+      final ClassSignature c = lookup.lookupRelatedClass(internalName);
+      if (c != null && c.isRuntimeClass && !AsmUtils.isPortableRuntimeClass(binaryClassName)) {
+        return String.format(Locale.ENGLISH,
+          "Forbidden %s use: %s [non-portable or internal runtime class]",
+          what, binaryClassName
+        );
       }
     }
     return null;
diff --git a/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.7.txt b/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.7.txt
index 76fbe65e..0bf580f2 100644
--- a/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.7.txt
+++ b/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.7.txt
@@ -2,7 +2,7 @@
 # It is provided here for reference, but can easily regenerated by executing from the source folder of forbidden-apis:
 # $ ant generate-deprecated
 
-# This file contains all public, deprecated API signatures in Java version 1.7 (extracted from build 1.7.0_65).
+# This file contains all public, deprecated API signatures in Java version 1.7 (extracted from build 1.7.0_80).
 
 @ignoreUnresolvable
 @defaultMessage Deprecated in Java 1.7
diff --git a/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.8.txt b/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.8.txt
index 9e0b93e5..fda3e8cf 100644
--- a/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.8.txt
+++ b/src/main/resources/de/thetaphi/forbiddenapis/signatures/jdk-deprecated-1.8.txt
@@ -2,7 +2,7 @@
 # It is provided here for reference, but can easily regenerated by executing from the source folder of forbidden-apis:
 # $ ant generate-deprecated
 
-# This file contains all public, deprecated API signatures in Java version 1.8 (extracted from build 1.8.0_25).
+# This file contains all public, deprecated API signatures in Java version 1.8 (extracted from build 1.8.0_60).
 
 @ignoreUnresolvable
 @defaultMessage Deprecated in Java 1.8
@@ -272,6 +272,9 @@ java.util.Date#setYear(int)
 java.util.Date#toGMTString()
 java.util.Date#toLocaleString()
 java.util.Properties#save(java.io.OutputStream,java.lang.String)
+java.util.jar.Attributes$Name#EXTENSION_INSTALLATION
+java.util.jar.Attributes$Name#IMPLEMENTATION_URL
+java.util.jar.Attributes$Name#IMPLEMENTATION_VENDOR_ID
 java.util.jar.Pack200$Packer#addPropertyChangeListener(java.beans.PropertyChangeListener)
 java.util.jar.Pack200$Packer#removePropertyChangeListener(java.beans.PropertyChangeListener)
 java.util.jar.Pack200$Unpacker#addPropertyChangeListener(java.beans.PropertyChangeListener)
diff --git a/src/test/antunit/TestInternalRuntimeCalls.xml b/src/test/antunit/TestInternalRuntimeCalls.xml
index 6a09bdab..61f40c95 100644
--- a/src/test/antunit/TestInternalRuntimeCalls.xml
+++ b/src/test/antunit/TestInternalRuntimeCalls.xml
@@ -22,7 +22,7 @@
         <file file="OracleInternalRuntime.class"/>
       </forbiddenapis>
     </au:expectfailure>
-    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-public internal runtime class]"/> 
+    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
   
diff --git a/src/test/java/de/thetaphi/forbiddenapis/AsmUtilsTest.java b/src/test/java/de/thetaphi/forbiddenapis/AsmUtilsTest.java
index bb332700..f2d84cb2 100644
--- a/src/test/java/de/thetaphi/forbiddenapis/AsmUtilsTest.java
+++ b/src/test/java/de/thetaphi/forbiddenapis/AsmUtilsTest.java
@@ -18,11 +18,13 @@
 
 import static de.thetaphi.forbiddenapis.AsmUtils.glob2Pattern;
 import static de.thetaphi.forbiddenapis.AsmUtils.isGlob;
-import static de.thetaphi.forbiddenapis.AsmUtils.isInternalClass;
+import static de.thetaphi.forbiddenapis.AsmUtils.isPortableRuntimeClass;
+import static de.thetaphi.forbiddenapis.AsmUtils.isRuntimeModule;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
+import java.util.ArrayList;
 import java.util.regex.Pattern;
 
 import org.junit.Test;
@@ -74,12 +76,25 @@ public void testCrazyPatterns() {
   }
   
   @Test
-  public void testInternalRuntime() {
-    assertTrue(isInternalClass("sun.misc.Unsafe"));
-    assertTrue(isInternalClass("jdk.internal.Asm"));
-    assertTrue(isInternalClass("sun.misc.Unsafe$1"));
-    assertFalse(isInternalClass(Object.class.getName()));
-    assertFalse(isInternalClass(getClass().getName()));
+  public void testPortableRuntime() {
+    assertFalse(isPortableRuntimeClass("sun.misc.Unsafe"));
+    assertFalse(isPortableRuntimeClass("jdk.internal.Asm"));
+    assertFalse(isPortableRuntimeClass("sun.misc.Unsafe$1"));
+    assertTrue(isPortableRuntimeClass(Object.class.getName()));
+    assertTrue(isPortableRuntimeClass(ArrayList.class.getName()));
+    assertTrue(isPortableRuntimeClass("org.w3c.dom.Document"));
+    assertFalse(isPortableRuntimeClass(getClass().getName()));
+  }
+  
+  @Test
+  public void testRuntimeModule() {
+    assertTrue(isRuntimeModule("java.base"));
+    assertTrue(isRuntimeModule("java.sql"));
+    assertTrue(isRuntimeModule("java.xml.ws"));
+    assertTrue(isRuntimeModule("jdk.nashorn"));
+    assertFalse(isRuntimeModule(null));
+    assertFalse(isRuntimeModule("foo"));
+    assertFalse(isRuntimeModule("foo.bar"));
   }
   
 }
diff --git a/src/tools/java/de/thetaphi/forbiddenapis/DeprecatedGen.java b/src/tools/java/de/thetaphi/forbiddenapis/DeprecatedGen.java
index 4193d7e0..87945583 100644
--- a/src/tools/java/de/thetaphi/forbiddenapis/DeprecatedGen.java
+++ b/src/tools/java/de/thetaphi/forbiddenapis/DeprecatedGen.java
@@ -80,7 +80,7 @@ protected void parseClass(InputStream in) throws IOException {
     // exclude internal classes like Unsafe,... and non-public classes!
     // Note: reader.getAccess() does no indicate if class is deprecated, as this is a special
     // attribute or annotation (both is handled later), we have to parse the class - this is just early exit!
-    if ((reader.getAccess() & ACC_PUBLIC) == 0 || AsmUtils.isInternalClass(className)) {
+    if ((reader.getAccess() & ACC_PUBLIC) == 0 || !AsmUtils.isPortableRuntimeClass(className)) {
       return;
     }
     reader.accept(new ClassVisitor(ASM5) {

From 205045a6bd8a719d8827f81cf144b0a6acdecdf2 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 00:00:53 +0100
Subject: [PATCH 02/14] Remove wrapping as List

---
 src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
index b2487b20..8514c347 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
@@ -17,7 +17,6 @@
  */
 
 import java.net.URL;
-import java.util.Arrays;
 import java.util.Locale;
 import java.util.regex.Pattern;
 
@@ -43,8 +42,8 @@ private AsmUtils() {}
   private static Pattern makePkgPrefixPattern(String... prefixes) {
     final StringBuilder sb = new StringBuilder();
     boolean first = true;
-    for (final String pkg : Arrays.asList(prefixes)) {
-      sb.append(first ? '(' : '|').append(Pattern.quote(pkg));
+    for (final String p : prefixes) {
+      sb.append(first ? '(' : '|').append(Pattern.quote(p));
       first = false;
     }
     sb.append(")").append(Pattern.quote(".")).append(".*");

From f2a4376d408f8694734146f6f719de673e5f2308 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 00:11:03 +0100
Subject: [PATCH 03/14] Make JRT parsing more safe

---
 src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
index 8514c347..103aeb2b 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
@@ -124,10 +124,13 @@ public static Pattern glob2Pattern(String... globs) {
     return Pattern.compile(regex.toString(), 0);
   }
   
-  /** Returns the module name from a {@code jrt:/} URL. */
+  /** Returns the module name from a {@code jrt:/} URL; returns null if no module given or wrong URL type. */
   public static String getModuleName(URL jrtUrl) {
+    if (!"jrt".equalsIgnoreCase(jrtUrl.getProtocol())) {
+      return null;
+    }
     String mod = jrtUrl.getPath();
-    if (mod != null) {
+    if (mod != null && mod.length() >= 1) {
       mod = mod.substring(1);
       int p = mod.indexOf('/');
       if (p >= 0) {

From 7726048c388e2e2338102e6efa2a7036d4e923b7 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 12:13:03 +0100
Subject: [PATCH 04/14] Add new bundled signatures 'jdk-nonportable', remove
 most old code. Remaining stuff will be deprecated soon

---
 .../de/thetaphi/forbiddenapis/Checker.java    | 26 ++++++++++++++-----
 .../thetaphi/forbiddenapis/ant/AntTask.java   |  4 +--
 .../thetaphi/forbiddenapis/cli/CliMain.java   |  7 ++---
 .../gradle/CheckForbiddenApis.java            |  5 ++--
 .../maven/AbstractCheckMojo.java              |  5 ++--
 .../forbiddenapis/CheckerSetupTest.java       |  4 +--
 6 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/Checker.java b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
index 040ba31a..a421b210 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/Checker.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
@@ -57,12 +57,13 @@
 public final class Checker implements RelatedClassLookup {
   
   public static enum Option {
-    INTERNAL_RUNTIME_FORBIDDEN,
     FAIL_ON_MISSING_CLASSES,
     FAIL_ON_VIOLATION,
     FAIL_ON_UNRESOLVABLE_SIGNATURES
   }
 
+  public static final String BS_JDK_NONPORTABLE = "jdk-nonportable";
+
   public final boolean isSupportedJDK;
   
   private final long start;
@@ -80,6 +81,8 @@ public static enum Option {
   // key is the binary name (dotted):
   final Map<String,ClassSignature> classpathClassCache = new HashMap<String,ClassSignature>();
   
+  // if enabled, the bundled signature to enable heuristics for detection of non-portable runtime calls is used:
+  private boolean forbidNonPortableRuntime = false;  
   // key is the internal name (slashed), followed by \000 and the field name:
   final Map<String,String> forbiddenFields = new HashMap<String,String>();
   // key is the internal name (slashed), followed by \000 and the method signature:
@@ -430,14 +433,19 @@ private void addSignature(final String line, final String defaultMessage, final
   }
 
   /** Reads a list of bundled API signatures from classpath. */
-  public void parseBundledSignatures(String name, String jdkTargetVersion) throws IOException,ParseException {
-    parseBundledSignatures(name, jdkTargetVersion, true);
+  public void addBundledSignatures(String name, String jdkTargetVersion) throws IOException,ParseException {
+    addBundledSignatures(name, jdkTargetVersion, true);
   }
   
-  private void parseBundledSignatures(String name, String jdkTargetVersion, boolean logging) throws IOException,ParseException {
+  private void addBundledSignatures(String name, String jdkTargetVersion, boolean logging) throws IOException,ParseException {
     if (!name.matches("[A-Za-z0-9\\-\\.]+")) {
       throw new ParseException("Invalid bundled signature reference: " + name);
     }
+    if (BS_JDK_NONPORTABLE.equals(name)) {
+      if (logging) logger.info("Reading bundled API signatures: " + name);
+      forbidNonPortableRuntime = true;
+      return;
+    }
     // use Checker.class hardcoded (not getClass) so we have a fixed package name:
     InputStream in = Checker.class.getResourceAsStream("signatures/" + name + ".txt");
     // automatically expand the compiler version in here (for jdk-* signatures without version):
@@ -498,7 +506,7 @@ private void parseSignaturesFile(Reader reader, boolean isBundled) throws IOExce
         if (line.startsWith("@")) {
           if (isBundled && line.startsWith(BUNDLED_PREFIX)) {
             final String name = line.substring(BUNDLED_PREFIX.length()).trim();
-            parseBundledSignatures(name, null, false);
+            addBundledSignatures(name, null, false);
           } else if (line.startsWith(DEFAULT_MESSAGE_PREFIX)) {
             defaultMessage = line.substring(DEFAULT_MESSAGE_PREFIX.length()).trim();
             if (defaultMessage.length() == 0) defaultMessage = null;
@@ -560,7 +568,11 @@ public void addClassesToCheck(File basedir, String... relativeNames) throws IOEx
   }
 
   public boolean hasNoSignatures() {
-    return forbiddenMethods.isEmpty() && forbiddenFields.isEmpty() && forbiddenClasses.isEmpty() && forbiddenClassPatterns.isEmpty() && (!options.contains(Option.INTERNAL_RUNTIME_FORBIDDEN));
+    return 0 == forbiddenMethods.size() + 
+        forbiddenFields.size() + 
+        forbiddenClasses.size() + 
+        forbiddenClassPatterns.size() +
+        (forbidNonPortableRuntime ? 1 : 0);
   }
   
   /** Adds the given annotation class for suppressing errors. */
@@ -576,7 +588,7 @@ public void addSuppressAnnotation(String annoName) {
   /** Parses a class and checks for valid method invocations */
   private int checkClass(final ClassReader reader, Pattern suppressAnnotationsPattern) {
     final String className = Type.getObjectType(reader.getClassName()).getClassName();
-    final ClassScanner scanner = new ClassScanner(this, forbiddenClasses, forbiddenClassPatterns, forbiddenMethods, forbiddenFields, suppressAnnotationsPattern, options.contains(Option.INTERNAL_RUNTIME_FORBIDDEN)); 
+    final ClassScanner scanner = new ClassScanner(this, forbiddenClasses, forbiddenClassPatterns, forbiddenMethods, forbiddenFields, suppressAnnotationsPattern, forbidNonPortableRuntime); 
     reader.accept(scanner, ClassReader.SKIP_FRAMES);
     final List<ForbiddenViolation> violations = scanner.getSortedViolations();
     final Pattern splitter = Pattern.compile(Pattern.quote(ForbiddenViolation.SEPARATOR));
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
index 49790210..d2a1e046 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
@@ -104,7 +104,6 @@ public void info(String msg) {
       apiSignatures.setProject(getProject());
       
       final EnumSet<Checker.Option> options = EnumSet.noneOf(Checker.Option.class);
-      if (internalRuntimeForbidden) options.add(INTERNAL_RUNTIME_FORBIDDEN);
       if (failOnMissingClasses) options.add(FAIL_ON_MISSING_CLASSES);
       if (failOnViolation) options.add(FAIL_ON_VIOLATION);
       if (failOnUnresolvableSignatures) options.add(FAIL_ON_UNRESOLVABLE_SIGNATURES);
@@ -132,8 +131,9 @@ public void info(String msg) {
           if (name == null) {
             throw new BuildException("<bundledSignatures/> must have the mandatory attribute 'name' referring to a bundled signatures file.");
           }
-          checker.parseBundledSignatures(name, null);
+          checker.addBundledSignatures(name, null);
         }
+        if (internalRuntimeForbidden) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
         
         @SuppressWarnings("unchecked")
         final Iterator<Resource> iter = apiSignatures.iterator();
diff --git a/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java b/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
index 26a749ed..8747a8c9 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
@@ -126,7 +126,7 @@ public CliMain(String... args) throws ExitException {
         .argName("classname")
         .build());
     options.addOption(internalruntimeforbiddenOpt = Option.builder()
-        .desc("forbids calls to classes from the internal java runtime (like sun.misc.Unsafe)")
+        .desc(String.format(Locale.ENGLISH, "DEPRECATED: forbids calls to non-portable runtime APIs; use bundled signatures '%s' instead", Checker.BS_JDK_NONPORTABLE))
         .longOpt("internalruntimeforbidden")
         .build());
     options.addOption(allowmissingclassesOpt = Option.builder()
@@ -216,7 +216,6 @@ public void run() throws ExitException {
     final URLClassLoader loader = URLClassLoader.newInstance(urls, ClassLoader.getSystemClassLoader());
     try {
       final EnumSet<Checker.Option> options = EnumSet.of(FAIL_ON_VIOLATION);
-      if (cmd.hasOption(internalruntimeforbiddenOpt.getLongOpt())) options.add(INTERNAL_RUNTIME_FORBIDDEN);
       if (!cmd.hasOption(allowmissingclassesOpt.getLongOpt())) options.add(FAIL_ON_MISSING_CLASSES);
       if (!cmd.hasOption(allowunresolvablesignaturesOpt.getLongOpt())) options.add(FAIL_ON_UNRESOLVABLE_SIGNATURES);
       final Checker checker = new Checker(LOG, loader, options);
@@ -258,8 +257,10 @@ public void run() throws ExitException {
       try {
         final String[] bundledSignatures = cmd.getOptionValues(bundledsignaturesOpt.getLongOpt());
         if (bundledSignatures != null) for (String bs : new LinkedHashSet<String>(Arrays.asList(bundledSignatures))) {
-          checker.parseBundledSignatures(bs, null);
+          checker.addBundledSignatures(bs, null);
         }
+        if (cmd.hasOption(internalruntimeforbiddenOpt.getLongOpt())) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        
         final String[] signaturesFiles = cmd.getOptionValues(signaturesfileOpt.getLongOpt());
         if (signaturesFiles != null) for (String sf : new LinkedHashSet<String>(Arrays.asList(signaturesFiles))) {
           final File f = new File(sf).getAbsoluteFile();
diff --git a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
index d6e73a59..49853d1c 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
@@ -473,7 +473,6 @@ public void info(String msg) {
     
     try {
       final EnumSet<Checker.Option> options = EnumSet.noneOf(Checker.Option.class);
-      if (getInternalRuntimeForbidden()) options.add(INTERNAL_RUNTIME_FORBIDDEN);
       if (getFailOnMissingClasses()) options.add(FAIL_ON_MISSING_CLASSES);
       if (!getIgnoreFailures()) options.add(FAIL_ON_VIOLATION);
       if (getFailOnUnresolvableSignatures()) options.add(FAIL_ON_UNRESOLVABLE_SIGNATURES);
@@ -508,9 +507,11 @@ public void info(String msg) {
               "You have to explicitely specify the version in the resource name.");
           }
           for (String bs : bundledSignatures) {
-            checker.parseBundledSignatures(bs, bundledSigsJavaVersion);
+            checker.addBundledSignatures(bs, bundledSigsJavaVersion);
           }
         }
+        if (getInternalRuntimeForbidden()) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        
         final FileCollection signaturesFiles = getSignaturesFiles();
         if (signaturesFiles != null) for (final File f : signaturesFiles) {
           checker.parseSignaturesFile(f);
diff --git a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
index 4bd2f029..27c01807 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
@@ -305,7 +305,6 @@ public void info(String msg) {
     
     try {
       final EnumSet<Checker.Option> options = EnumSet.noneOf(Checker.Option.class);
-      if (internalRuntimeForbidden) options.add(INTERNAL_RUNTIME_FORBIDDEN);
       if (failOnMissingClasses) options.add(FAIL_ON_MISSING_CLASSES);
       if (failOnViolation) options.add(FAIL_ON_VIOLATION);
       if (failOnUnresolvableSignatures) options.add(FAIL_ON_UNRESOLVABLE_SIGNATURES);
@@ -360,9 +359,11 @@ public void info(String msg) {
               "You have to explicitely specify the version in the resource name.");
           }
           for (String bs : new LinkedHashSet<String>(Arrays.asList(bundledSignatures))) {
-            checker.parseBundledSignatures(bs, targetVersion);
+            checker.addBundledSignatures(bs, targetVersion);
           }
         }
+        if (internalRuntimeForbidden) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        
         final Set<File> sigFiles = new LinkedHashSet<File>();
         final Set<URL> sigUrls = new LinkedHashSet<URL>();
         if (signaturesFiles != null) {
diff --git a/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java b/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
index 2a0e43db..3ca3bfff 100644
--- a/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
+++ b/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
@@ -32,9 +32,9 @@ public final class CheckerSetupTest {
   
   @Before
   public void setUp() {
-    checker = new Checker(StdIoLogger.INSTANCE, ClassLoader.getSystemClassLoader(), INTERNAL_RUNTIME_FORBIDDEN, FAIL_ON_MISSING_CLASSES, FAIL_ON_VIOLATION, FAIL_ON_UNRESOLVABLE_SIGNATURES);
+    checker = new Checker(StdIoLogger.INSTANCE, ClassLoader.getSystemClassLoader(), FAIL_ON_MISSING_CLASSES, FAIL_ON_VIOLATION, FAIL_ON_UNRESOLVABLE_SIGNATURES);
     assumeTrue("This test only works with a supported JDK (see docs)", checker.isSupportedJDK);
-    assertEquals(EnumSet.of(INTERNAL_RUNTIME_FORBIDDEN, FAIL_ON_MISSING_CLASSES, FAIL_ON_VIOLATION, FAIL_ON_UNRESOLVABLE_SIGNATURES), checker.options);
+    assertEquals(EnumSet.of(FAIL_ON_MISSING_CLASSES, FAIL_ON_VIOLATION, FAIL_ON_UNRESOLVABLE_SIGNATURES), checker.options);
   }
 
   @Test

From cf2c3601b18ae0cf7cd477366f13a2fbeae7ef5d Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 13:56:33 +0100
Subject: [PATCH 05/14] Add documentation

---
 src/main/docs/ant-task.html                       |  3 ++-
 src/main/docs/bundled-signatures.html             | 15 +++++++++++----
 .../de/thetaphi/forbiddenapis/ant/AntTask.java    |  7 +++++--
 .../forbiddenapis/gradle/CheckForbiddenApis.java  | 12 +++++++++---
 .../gradle/CheckForbiddenApisExtension.java       |  4 ++--
 .../forbiddenapis/maven/AbstractCheckMojo.java    |  5 ++++-
 6 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/src/main/docs/ant-task.html b/src/main/docs/ant-task.html
index 86656579..e4874004 100644
--- a/src/main/docs/ant-task.html
+++ b/src/main/docs/ant-task.html
@@ -120,7 +120,8 @@ <h2>Parameters</h2>
   <td>internalRuntimeForbidden</td>
   <td><code>boolean</code></td>
   <td><code>false</code></td>
-  <td>Forbids calls to classes from the internal java runtime (like <code>sun.misc.Unsafe</code>).</td>
+  <td>Forbids calls to non-portable runtime APIs (like <code>sun.misc.Unsafe</code>). <em>Please note:</em> This enables <code>"jdk-nonportable"</code> bundled signatures for backwards compatibility.<br>
+  <strong>Deprecated.</strong> Use <a href="bundled-signatures.html">bundled signatures</a> <code>"jdk-nonportable"</code> or <code>"jdk-internal"</code> instead.</td>
 </tr>
 
 <tr>
diff --git a/src/main/docs/bundled-signatures.html b/src/main/docs/bundled-signatures.html
index a9735917..4a1aa078 100644
--- a/src/main/docs/bundled-signatures.html
+++ b/src/main/docs/bundled-signatures.html
@@ -34,16 +34,23 @@ <h1>Bundled Signatures Documentation</h1>
 <li><strong><tt>jdk-deprecated-*</tt>:</strong> This disallows all deprecated
 methods from the JDK (for Java <tt>*</tt> = 1.6, 1.7, 1.8; Maven / Gradle automatically add the compile Java version).</li>
 
+<li><strong><tt>jdk-internal-*</tt>:</strong> Lists all internal packages of the JDK as of <code>Security.getProperty(&quot;package.access&quot;)</code>.
+Calling those methods will always trigger security manager and is completely forbidden from Java 9 on
+(for Java <tt>*</tt> = 1.6, 1.7, 1.8; Maven / Gradle automatically add the compile Java version, <em>since forbiddenapis v2.1</em>).</li>
+
+<li><strong><tt>jdk-nonportable</tt>:</strong> Signatures of all non-portable (like <code>com.sun.management.HotSpotDiagnosticMXBean</code>)
+or internal runtime APIs (like <code>sun.misc.Unsafe</code>). This is a superset of <tt>jdk-internal</tt>.<br>
+<em>Internally this is implemented using heuristics:</em> Any reference to an API that is part of the Java runtime (<tt>rt.jar</tt>, extensions,
+Java 9 <tt>java.*</tt> / <tt>jdk.*</tt> core modules) and is <strong>not</strong> part of the Java SE specification packages
+(mainly <tt>java</tt>, <tt>javax</tt>, but also <tt>org.ietf.jgss</tt>, <tt>org.omg</tt>, <tt>org.w3c.dom</tt>, and <tt>org.xml.sax</tt>) is forbidden
+(any java version, no specific JDK version, <em>since forbiddenapis v2.1</em>).</li>
+
 <li><strong><tt>jdk-system-out</tt>:</strong> On server-side applications or libraries used by other programs, printing to
 <tt>System.out</tt> or <tt>System.err</tt> is discouraged and should be avoided (any java version, no specific JDK version).</li>
 
 <li><strong><tt>jdk-reflection</tt>:</strong> Reflection usage to work around access flags fails with SecurityManagers
 and likely will not work anymore on runtime classes in Java 9 (any java version, no specific JDK version, <em>since forbiddenapis v2.1</em>).</li>
 
-<li><strong><tt>jdk-internal</tt>:</strong> Lists all internal packages of the JDK as of <code>Security.getProperty(&quot;package.access&quot;)</code>.
-Calling those methods will always trigger security manager and is completely forbidden from Java 9 on
-(for Java <tt>*</tt> = 1.6, 1.7, 1.8; Maven / Gradle automatically add the compile Java version, <em>since forbiddenapis v2.1</em>).</li>
-
 <li><strong><tt>commons-io-unsafe-*</tt>:</strong> If your application uses the famous <i>Apache Common-IO</i> library,
 this adds signatures of all methods that depend on default charset
 (for versions <tt>*</tt> = 1.0, 1.1, 1.2, 1.3, 1.4, 2.0, 2.1, 2.2, 2.3, 2.4).</li>
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
index d2a1e046..aadf4f14 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
@@ -63,7 +63,7 @@ public class AntTask extends Task {
   private Path classpath = null;
   
   private boolean failOnUnsupportedJava = false;
-  private boolean internalRuntimeForbidden = false;
+  @Deprecated private boolean internalRuntimeForbidden = false;
   private boolean restrictClassFilename = true;
   private boolean failOnMissingClasses = true;
   private boolean failOnUnresolvableSignatures = true;
@@ -320,9 +320,12 @@ public void setFailOnUnresolvableSignatures(boolean failOnUnresolvableSignatures
   }
 
   /**
-   * Forbids calls to classes from the internal java runtime (like sun.misc.Unsafe)
+   * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
+   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
    * Defaults to {@code false}. 
+   * @deprecated Use bundled signatures {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
    */
+  @Deprecated
   public void setInternalRuntimeForbidden(boolean internalRuntimeForbidden) {
     this.internalRuntimeForbidden = internalRuntimeForbidden;
   }
diff --git a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
index 49853d1c..ba48fb98 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
@@ -218,15 +218,21 @@ public void setBundledSignatures(Set<String> bundledSignatures) {
   }
 
   /**
-   * Forbids calls to classes from the internal java runtime (like sun.misc.Unsafe)
-   * Defaults to {@code false}.
+   * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
+   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
+   * Defaults to {@code false}. 
+   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
    */
+  @Deprecated
   @Input
   public boolean getInternalRuntimeForbidden() {
     return data.internalRuntimeForbidden;
   }
 
-  /** @see #getInternalRuntimeForbidden */
+  /** @see #getInternalRuntimeForbidden
+   * @deprecated Use bundled signatures {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
+   */
+  @Deprecated
   public void setInternalRuntimeForbidden(boolean internalRuntimeForbidden) {
     data.internalRuntimeForbidden = internalRuntimeForbidden;
   }
diff --git a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApisExtension.java b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApisExtension.java
index 6ff9978c..9de9da75 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApisExtension.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApisExtension.java
@@ -52,8 +52,8 @@ public class CheckForbiddenApisExtension {
   public List<String> signatures = new ArrayList<String>();
   public Set<String> bundledSignatures = new LinkedHashSet<String>(),
     suppressAnnotations = new LinkedHashSet<String>();
-  public boolean internalRuntimeForbidden = false,
-    failOnUnsupportedJava = false,
+  @Deprecated public boolean internalRuntimeForbidden = false;
+  public boolean failOnUnsupportedJava = false,
     failOnMissingClasses = true,
     failOnUnresolvableSignatures = true,
     ignoreFailures = false;
diff --git a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
index 27c01807..63da7281 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
@@ -112,9 +112,12 @@ public abstract class AbstractCheckMojo extends AbstractMojo {
   private String[] bundledSignatures;
 
   /**
-   * Forbids calls to classes from the internal java runtime (like sun.misc.Unsafe)
+   * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
+   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
+   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
    * @since 1.0
    */
+  @Deprecated
   @Parameter(required = false, defaultValue = "false")
   private boolean internalRuntimeForbidden;
 

From c02b1721660c4e59c63ccf958175c4894e6b8546 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 20:04:00 +0100
Subject: [PATCH 06/14] Add deprecated warning to task executions

---
 .../de/thetaphi/forbiddenapis/Checker.java    | 11 +++----
 .../de/thetaphi/forbiddenapis/Constants.java  | 30 +++++++++++++++++++
 .../thetaphi/forbiddenapis/ant/AntTask.java   |  8 +++--
 .../thetaphi/forbiddenapis/cli/CliMain.java   | 10 +++++--
 .../gradle/CheckForbiddenApis.java            |  8 +++--
 .../maven/AbstractCheckMojo.java              |  8 +++--
 6 files changed, 59 insertions(+), 16 deletions(-)
 create mode 100644 src/main/java/de/thetaphi/forbiddenapis/Constants.java

diff --git a/src/main/java/de/thetaphi/forbiddenapis/Checker.java b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
index a421b210..f95e1686 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/Checker.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
@@ -54,7 +54,7 @@
 /**
  * Forbidden APIs checker class.
  */
-public final class Checker implements RelatedClassLookup {
+public final class Checker implements RelatedClassLookup, Constants {
   
   public static enum Option {
     FAIL_ON_MISSING_CLASSES,
@@ -62,16 +62,13 @@ public static enum Option {
     FAIL_ON_UNRESOLVABLE_SIGNATURES
   }
 
-  public static final String BS_JDK_NONPORTABLE = "jdk-nonportable";
-
   public final boolean isSupportedJDK;
   
   private final long start;
-  
+  private final NavigableSet<String> runtimePaths;
+    
   final Logger logger;
   
-  final NavigableSet<String> runtimePaths;
-  
   final ClassLoader loader;
   final java.lang.reflect.Method method_Class_getModule, method_Module_getResourceAsStream, method_Module_getName;
   final EnumSet<Option> options;
@@ -89,7 +86,7 @@ public static enum Option {
   final Map<String,String> forbiddenMethods = new HashMap<String,String>();
   // key is the internal name (slashed):
   final Map<String,String> forbiddenClasses = new HashMap<String,String>();
-  // key is pattern to binary class name:
+  // set of patterns of forbidden classes:
   final Set<ClassPatternRule> forbiddenClassPatterns = new LinkedHashSet<ClassPatternRule>();
   // descriptors (not internal names) of all annotations that suppress:
   final Set<String> suppressAnnotations = new LinkedHashSet<String>();
diff --git a/src/main/java/de/thetaphi/forbiddenapis/Constants.java b/src/main/java/de/thetaphi/forbiddenapis/Constants.java
new file mode 100644
index 00000000..89fed26b
--- /dev/null
+++ b/src/main/java/de/thetaphi/forbiddenapis/Constants.java
@@ -0,0 +1,30 @@
+package de.thetaphi.forbiddenapis;
+
+import java.util.Locale;
+
+/*
+ * (C) Copyright Uwe Schindler (Generics Policeman) and others.
+ * Parts of this work are licensed to the Apache Software Foundation (ASF)
+ * under one or more contributor license agreements.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+public interface Constants {
+
+  final String BS_JDK_NONPORTABLE = "jdk-nonportable";
+  
+  final String DEPRECATED_WARN_INTERNALRUNTIME = String.format(Locale.ENGLISH,
+      "The setting 'internalRuntimeForbidden' was deprecated and will be removed in next version. For backwards compatibility task/mojo is using '%s' bundled signatures instead.", BS_JDK_NONPORTABLE);
+  
+}
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
index aadf4f14..f63a2fc0 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
@@ -36,6 +36,7 @@
 import org.apache.tools.ant.types.resources.Union;
 
 import de.thetaphi.forbiddenapis.Checker;
+import de.thetaphi.forbiddenapis.Constants;
 import de.thetaphi.forbiddenapis.ForbiddenApiException;
 import de.thetaphi.forbiddenapis.Logger;
 import de.thetaphi.forbiddenapis.ParseException;
@@ -54,7 +55,7 @@
  * In contrast to other ANT tasks, this tool does only visit the given classpath
  * and the system classloader, not ANT's class loader.
  */
-public class AntTask extends Task {
+public class AntTask extends Task implements Constants {
 
   private final Union classFiles = new Union();
   private final Union apiSignatures = new Union();
@@ -133,7 +134,10 @@ public void info(String msg) {
           }
           checker.addBundledSignatures(name, null);
         }
-        if (internalRuntimeForbidden) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        if (internalRuntimeForbidden) {
+          log.warn(DEPRECATED_WARN_INTERNALRUNTIME);
+          checker.addBundledSignatures(BS_JDK_NONPORTABLE, null);
+        }
         
         @SuppressWarnings("unchecked")
         final Iterator<Resource> iter = apiSignatures.iterator();
diff --git a/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java b/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
index 8747a8c9..d69fb30a 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/cli/CliMain.java
@@ -42,6 +42,7 @@
 
 import de.thetaphi.forbiddenapis.AsmUtils;
 import de.thetaphi.forbiddenapis.Checker;
+import de.thetaphi.forbiddenapis.Constants;
 import de.thetaphi.forbiddenapis.ForbiddenApiException;
 import de.thetaphi.forbiddenapis.Logger;
 import de.thetaphi.forbiddenapis.ParseException;
@@ -50,7 +51,7 @@
 /**
  * CLI class with a static main() method
  */
-public final class CliMain {
+public final class CliMain implements Constants {
 
   private final Option classpathOpt, dirOpt, includesOpt, excludesOpt, signaturesfileOpt, bundledsignaturesOpt, suppressannotationsOpt,
     internalruntimeforbiddenOpt, allowmissingclassesOpt, allowunresolvablesignaturesOpt, versionOpt, helpOpt;
@@ -126,7 +127,7 @@ public CliMain(String... args) throws ExitException {
         .argName("classname")
         .build());
     options.addOption(internalruntimeforbiddenOpt = Option.builder()
-        .desc(String.format(Locale.ENGLISH, "DEPRECATED: forbids calls to non-portable runtime APIs; use bundled signatures '%s' instead", Checker.BS_JDK_NONPORTABLE))
+        .desc(String.format(Locale.ENGLISH, "DEPRECATED: forbids calls to non-portable runtime APIs; use bundled signatures '%s' instead", BS_JDK_NONPORTABLE))
         .longOpt("internalruntimeforbidden")
         .build());
     options.addOption(allowmissingclassesOpt = Option.builder()
@@ -259,7 +260,10 @@ public void run() throws ExitException {
         if (bundledSignatures != null) for (String bs : new LinkedHashSet<String>(Arrays.asList(bundledSignatures))) {
           checker.addBundledSignatures(bs, null);
         }
-        if (cmd.hasOption(internalruntimeforbiddenOpt.getLongOpt())) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        if (cmd.hasOption(internalruntimeforbiddenOpt.getLongOpt())) {
+          LOG.warn(DEPRECATED_WARN_INTERNALRUNTIME);
+          checker.addBundledSignatures(BS_JDK_NONPORTABLE, null);
+        }
         
         final String[] signaturesFiles = cmd.getOptionValues(signaturesfileOpt.getLongOpt());
         if (signaturesFiles != null) for (String sf : new LinkedHashSet<String>(Arrays.asList(signaturesFiles))) {
diff --git a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
index ba48fb98..9fff75a1 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
@@ -52,6 +52,7 @@
 import org.gradle.api.tasks.util.PatternSet;
 
 import de.thetaphi.forbiddenapis.Checker;
+import de.thetaphi.forbiddenapis.Constants;
 import de.thetaphi.forbiddenapis.ForbiddenApiException;
 import de.thetaphi.forbiddenapis.Logger;
 import de.thetaphi.forbiddenapis.ParseException;
@@ -102,7 +103,7 @@
  * @since 2.0
  */
 @ParallelizableTask
-public class CheckForbiddenApis extends DefaultTask implements PatternFilterable,VerificationTask {
+public class CheckForbiddenApis extends DefaultTask implements PatternFilterable,VerificationTask,Constants {
   
   private static final String NL = System.getProperty("line.separator", "\n");
   
@@ -516,7 +517,10 @@ public void info(String msg) {
             checker.addBundledSignatures(bs, bundledSigsJavaVersion);
           }
         }
-        if (getInternalRuntimeForbidden()) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        if (getInternalRuntimeForbidden()) {
+          log.warn(DEPRECATED_WARN_INTERNALRUNTIME);
+          checker.addBundledSignatures(BS_JDK_NONPORTABLE, null);
+        }
         
         final FileCollection signaturesFiles = getSignaturesFiles();
         if (signaturesFiles != null) for (final File f : signaturesFiles) {
diff --git a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
index 63da7281..e2cb15f0 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
@@ -31,6 +31,7 @@
 import org.codehaus.plexus.util.DirectoryScanner;
 
 import de.thetaphi.forbiddenapis.Checker;
+import de.thetaphi.forbiddenapis.Constants;
 import de.thetaphi.forbiddenapis.ForbiddenApiException;
 import de.thetaphi.forbiddenapis.Logger;
 import de.thetaphi.forbiddenapis.ParseException;
@@ -55,7 +56,7 @@
  * Base class for forbiddenapis Mojos.
  * @since 1.0
  */
-public abstract class AbstractCheckMojo extends AbstractMojo {
+public abstract class AbstractCheckMojo extends AbstractMojo implements Constants {
 
   /**
    * Lists all files, which contain signatures and comments for forbidden API calls.
@@ -365,7 +366,10 @@ public void info(String msg) {
             checker.addBundledSignatures(bs, targetVersion);
           }
         }
-        if (internalRuntimeForbidden) checker.addBundledSignatures(Checker.BS_JDK_NONPORTABLE, null);
+        if (internalRuntimeForbidden) {
+          log.warn(DEPRECATED_WARN_INTERNALRUNTIME);
+          checker.addBundledSignatures(BS_JDK_NONPORTABLE, null);
+        }
         
         final Set<File> sigFiles = new LinkedHashSet<File>();
         final Set<URL> sigUrls = new LinkedHashSet<URL>();

From 239ff0b8dfce9c86aad408ac6bf062c439833235 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Mon, 28 Dec 2015 20:25:23 +0100
Subject: [PATCH 07/14] Convert tests to new bundled signatures

---
 build.xml                                     |  4 +--
 src/test/antunit/TestCli.xml                  |  3 +--
 src/test/antunit/TestDeprecatedTask.xml       |  3 ++-
 src/test/antunit/TestFinalJAR.xml             | 12 ++++++---
 src/test/antunit/TestInternalRuntimeCalls.xml | 25 ++++++++++++++++++-
 src/test/antunit/pom-InclExclSuppress.xml     |  1 -
 src/test/antunit/pom-generator.xsl            |  2 +-
 src/test/antunit/pom-sigArtifacts.xml         |  1 -
 src/test/gradle/build.gradle                  |  2 +-
 9 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/build.xml b/build.xml
index 72a4d2ed..1cc90ffa 100644
--- a/build.xml
+++ b/build.xml
@@ -461,7 +461,7 @@
   </target>
   
   <target name="-check-myself" depends="compile,compile-tools,compile-test,-install-forbiddenapi-task">
-    <forbiddenapis internalRuntimeForbidden="true" failOnUnsupportedJava="false">
+    <forbiddenapis failOnUnsupportedJava="false">
       <classpath refid="path.all"/>
       <fileset dir="build/main"/>
       <fileset dir="build/tools"/>
@@ -469,7 +469,7 @@
       <signatures>
         <bundled name="jdk-unsafe-${jdk.version}"/>
         <bundled name="jdk-deprecated-${jdk.version}"/>
-        <bundled name="jdk-internal-${jdk.version}"/>
+        <bundled name="jdk-nonportable"/>
         <bundled name="jdk-system-out"/>
         <bundled name="jdk-reflection"/>
       </signatures>
diff --git a/src/test/antunit/TestCli.xml b/src/test/antunit/TestCli.xml
index c1c2c887..285bdc33 100644
--- a/src/test/antunit/TestCli.xml
+++ b/src/test/antunit/TestCli.xml
@@ -25,8 +25,7 @@
       <arg value="-d"/>
       <arg file="${antunit.main.classes}"/>
       <arg value="-b"/>
-      <arg value="jdk-unsafe-${jdk.version},jdk-deprecated-${jdk.version}"/>
-      <arg value="--internalruntimeforbidden"/>
+      <arg value="jdk-unsafe-${jdk.version},jdk-deprecated-${jdk.version},jdk-nonportable"/>
     </java>
     <au:assertLogContains text=" 0 error(s)."/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-deprecated-${jdk.version}"/> 
diff --git a/src/test/antunit/TestDeprecatedTask.xml b/src/test/antunit/TestDeprecatedTask.xml
index 78475a87..be853274 100644
--- a/src/test/antunit/TestDeprecatedTask.xml
+++ b/src/test/antunit/TestDeprecatedTask.xml
@@ -19,10 +19,11 @@
   <taskdef name="forbiddenapis-deprecated" classname="de.thetaphi.forbiddenapis.AntTask" classpath="${jar-file}"/>
 
   <target name="testMySelf">
-    <forbiddenapis-deprecated internalRuntimeForbidden="true" classpathref="path.all">
+    <forbiddenapis-deprecated classpathref="path.all">
       <fileset dir="${antunit.main.classes}"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
+      <bundledsignatures name="jdk-nonportable"/>
     </forbiddenapis-deprecated>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
     <au:assertLogContains level="warn" text="DEPRECATED-WARNING"/> 
diff --git a/src/test/antunit/TestFinalJAR.xml b/src/test/antunit/TestFinalJAR.xml
index 1ded8638..32dfbbe2 100644
--- a/src/test/antunit/TestFinalJAR.xml
+++ b/src/test/antunit/TestFinalJAR.xml
@@ -19,27 +19,30 @@
   <taskdef name="forbiddenapis-jar" classname="de.thetaphi.forbiddenapis.ant.AntTask" classpath="${jar-file}"/>
 
   <target name="testMySelfWithFinalJAR1">
-    <forbiddenapis-jar internalRuntimeForbidden="true" classpathref="path.all">
+    <forbiddenapis-jar classpathref="path.all">
       <fileset dir="${antunit.main.classes}"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
+      <bundledsignatures name="jdk-nonportable"/>
     </forbiddenapis-jar>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
   
   <target name="testMySelfWithFinalJAR2">
-    <forbiddenapis-jar dir="${antunit.main.classes}" internalRuntimeForbidden="true" classpathref="path.all">
+    <forbiddenapis-jar dir="${antunit.main.classes}" classpathref="path.all">
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
+      <bundledsignatures name="jdk-nonportable"/>
     </forbiddenapis-jar>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
   
   <target name="testMySelfWithAntLib">
     <taskdef uri="antlib:de.thetaphi.forbiddenapis" classpath="${jar-file}"/>
-    <fa:forbiddenapis xmlns:fa="antlib:de.thetaphi.forbiddenapis" dir="${antunit.main.classes}" internalRuntimeForbidden="true" classpathref="path.all">
+    <fa:forbiddenapis xmlns:fa="antlib:de.thetaphi.forbiddenapis" dir="${antunit.main.classes}" classpathref="path.all">
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
+      <bundledsignatures name="jdk-nonportable"/>
     </fa:forbiddenapis>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
@@ -52,10 +55,11 @@
     only plexus-utils v1.1, which is much slimmer and does not reference
     broken StringUtils. ASM is completely forbidden-api bug-free!
     -->
-    <forbiddenapis-jar internalRuntimeForbidden="true">
+    <forbiddenapis-jar>
       <zipfileset src="${jar-file}" excludes="de/thetaphi/forbiddenapis/commons/cli/**"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
+      <bundledsignatures name="jdk-nonportable"/>
       <classpath>
         <pathelement path="${jar-file}"/>
         <path refid="path.main-build"/>
diff --git a/src/test/antunit/TestInternalRuntimeCalls.xml b/src/test/antunit/TestInternalRuntimeCalls.xml
index 61f40c95..67ddfdf8 100644
--- a/src/test/antunit/TestInternalRuntimeCalls.xml
+++ b/src/test/antunit/TestInternalRuntimeCalls.xml
@@ -16,12 +16,35 @@
 -->
 <project xmlns:au="antlib:org.apache.ant.antunit">
 
-  <target name="testInternalRuntimeForbidden">
+  <target name="testNonPortableSignatures">
+    <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
+      <forbiddenapis failOnMissingClasses="false">
+        <file file="OracleInternalRuntime.class"/>
+        <bundledsignatures name="jdk-nonportable"/>
+      </forbiddenapis>
+    </au:expectfailure>
+    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
+    <au:assertLogContains level="error" text=" 2 error(s)"/> 
+  </target>
+  
+  <target name="testInternalSignatures">
+    <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
+      <forbiddenapis failOnMissingClasses="false">
+        <file file="OracleInternalRuntime.class"/>
+        <bundledsignatures name="jdk-internal-${jdk.version}"/>
+      </forbiddenapis>
+    </au:expectfailure>
+    <au:assertLogContains level="error" text="sun.** [non-public internal runtime class in Java ${jdk.version}]"/> 
+    <au:assertLogContains level="error" text=" 2 error(s)"/> 
+  </target>
+  
+  <target name="testDeprecatedInternalRuntimeForbidden">
     <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
       <forbiddenapis internalRuntimeForbidden="true" failOnMissingClasses="false">
         <file file="OracleInternalRuntime.class"/>
       </forbiddenapis>
     </au:expectfailure>
+    <au:assertLogContains level="warn" text="The setting 'internalRuntimeForbidden' was deprecated"/> 
     <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
diff --git a/src/test/antunit/pom-InclExclSuppress.xml b/src/test/antunit/pom-InclExclSuppress.xml
index d2b0adb7..0030b08f 100644
--- a/src/test/antunit/pom-InclExclSuppress.xml
+++ b/src/test/antunit/pom-InclExclSuppress.xml
@@ -30,7 +30,6 @@
         <version>${version}</version>
         <configuration>
           <classesDirectory>.</classesDirectory>
-          <internalRuntimeForbidden>false</internalRuntimeForbidden>
           <failOnUnresolvableSignatures>true</failOnUnresolvableSignatures>
           <bundledSignatures>
             <bundledSignature>jdk-system-out</bundledSignature>
diff --git a/src/test/antunit/pom-generator.xsl b/src/test/antunit/pom-generator.xsl
index 253c70b3..c816a988 100644
--- a/src/test/antunit/pom-generator.xsl
+++ b/src/test/antunit/pom-generator.xsl
@@ -46,12 +46,12 @@
             <artifactId>${artifactId}</artifactId>
             <version>${version}</version>
             <configuration>
-              <internalRuntimeForbidden>true</internalRuntimeForbidden>
               <failOnUnresolvableSignatures>${antunit.failOnUnresolvableSignatures}</failOnUnresolvableSignatures>
               <failOnViolation>${antunit.failOnViolation}</failOnViolation>
               <bundledSignatures>
                 <bundledSignature>jdk-unsafe</bundledSignature>
                 <bundledSignature>jdk-deprecated</bundledSignature>
+                <bundledSignature>jdk-nonportable</bundledSignature>
                 <bundledSignature>jdk-system-out</bundledSignature>
               </bundledSignatures>
               <signatures>${antunit.signatures}</signatures>
diff --git a/src/test/antunit/pom-sigArtifacts.xml b/src/test/antunit/pom-sigArtifacts.xml
index d5a60df1..c87ba533 100644
--- a/src/test/antunit/pom-sigArtifacts.xml
+++ b/src/test/antunit/pom-sigArtifacts.xml
@@ -30,7 +30,6 @@
         <version>${version}</version>
         <configuration>
           <classesDirectory>.</classesDirectory>
-          <internalRuntimeForbidden>false</internalRuntimeForbidden>
           <failOnMissingClasses>false</failOnMissingClasses>
           <signaturesArtifacts>
             <signaturesArtifact>
diff --git a/src/test/gradle/build.gradle b/src/test/gradle/build.gradle
index 06270999..2bdecc5e 100644
--- a/src/test/gradle/build.gradle
+++ b/src/test/gradle/build.gradle
@@ -32,7 +32,7 @@ apply plugin: 'de.thetaphi.forbiddenapis'
 sourceCompatibility = forbiddenSourceCompatibility
 
 forbiddenApis {
-  bundledSignatures = [ 'jdk-unsafe', 'jdk-deprecated' ]
+  bundledSignatures = [ 'jdk-unsafe', 'jdk-deprecated', 'jdk-nonportable' ]
   failOnUnsupportedJava = false
 }
 

From 731504f5075c16fcc5ae181930a818791e7623d8 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 00:26:41 +0100
Subject: [PATCH 08/14] Improve printout, if glob patterns are used (don't
 print glob, instead the real class name)

---
 .../de/thetaphi/forbiddenapis/Checker.java    | 11 +++---
 .../forbiddenapis/ClassPatternRule.java       | 36 ++++++++++---------
 .../thetaphi/forbiddenapis/ClassScanner.java  |  2 +-
 src/test/antunit/TestInlineSignatures.xml     |  4 +--
 src/test/antunit/TestInternalRuntimeCalls.xml |  2 +-
 .../forbiddenapis/CheckerSetupTest.java       |  2 +-
 6 files changed, 32 insertions(+), 25 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/Checker.java b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
index f95e1686..494ef7db 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/Checker.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/Checker.java
@@ -347,7 +347,8 @@ public ClassSignature lookupRelatedClass(String internalName) {
   
   /** Adds the method signature to the list of disallowed methods. The Signature is checked against the given ClassLoader. */
   private void addSignature(final String line, final String defaultMessage, final UnresolvableReporting report) throws ParseException,IOException {
-    final String clazz, field, signature, message;
+    final String clazz, field, signature;
+    String message = null;
     final Method method;
     int p = line.indexOf('@');
     if (p >= 0) {
@@ -382,15 +383,17 @@ private void addSignature(final String line, final String defaultMessage, final
       method = null;
       field = null;
     }
+    if (message != null && message.isEmpty()) {
+      message = null;
+    }
     // create printout message:
-    final String printout = (message != null && message.length() > 0) ?
-      (signature + " [" + message + "]") : signature;
+    final String printout = (message != null) ? (signature + " [" + message + "]") : signature;
     // check class & method/field signature, if it is really existent (in classpath), but we don't really load the class into JVM:
     if (AsmUtils.isGlob(clazz)) {
       if (method != null || field != null) {
         throw new ParseException(String.format(Locale.ENGLISH, "Class level glob pattern cannot be combined with methods/fields: %s", signature));
       }
-      forbiddenClassPatterns.add(new ClassPatternRule(clazz, printout));
+      forbiddenClassPatterns.add(new ClassPatternRule(clazz, message));
     } else {
       final ClassSignature c;
       try {
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ClassPatternRule.java b/src/main/java/de/thetaphi/forbiddenapis/ClassPatternRule.java
index d5bae1e2..a9a615e3 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ClassPatternRule.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ClassPatternRule.java
@@ -21,34 +21,34 @@
 public final class ClassPatternRule {
 
   private final Pattern pattern;
-  
-  /** the message printed if rule is violated */
-  public final String printout;
+  private final String glob, message;
   
   /** Create new rule for class glob and given printout */
-  public ClassPatternRule(String glob, String printout) {
-    if (glob == null || printout == null) {
-      throw new NullPointerException();
+  public ClassPatternRule(String glob, String message) {
+    if (glob == null) {
+      throw new NullPointerException("glob");
     }
+    this.glob = glob;
     this.pattern = AsmUtils.glob2Pattern(glob);
-    assert this.pattern.flags() == 0 : "the pattern should have no flags (must be case-sensitive,...)";
-    this.printout = printout;
+    this.message = message;
   }
   
   /** returns true, if the given class (binary name, dotted) matches this rule. */
   public boolean matches(String className) {
     return pattern.matcher(className).matches();
   }
-
-  // equals() / hashCode() use the string representation of pattern for comparisons
-  // (Pattern unfortunately does not implement equals/hashCode)
   
+  /** returns the printout using the message and the given class name */
+  public String getPrintout(String className) {
+    return message == null ? className : (className + " [" + message + "]");
+  }
+
   @Override
   public int hashCode() {
     final int prime = 31;
     int result = 1;
-    result = prime * result + pattern.pattern().hashCode();
-    result = prime * result + printout.hashCode();
+    result = prime * result + glob.hashCode();
+    result = prime * result + ((message == null) ? 0 : message.hashCode());
     return result;
   }
 
@@ -58,14 +58,18 @@ public boolean equals(Object obj) {
     if (obj == null) return false;
     if (getClass() != obj.getClass()) return false;
     ClassPatternRule other = (ClassPatternRule) obj;
-    if (!pattern.pattern().equals(other.pattern.pattern())) return false;
-    if (!printout.equals(other.printout)) return false;
+    if (!glob.equals(other.glob)) return false;
+    if (message == null) {
+      if (other.message != null) return false;
+    } else if (!message.equals(other.message)) {
+      return false;
+    }
     return true;
   }
 
   @Override
   public String toString() {
-    return "ClassPatternRule [pattern=" + pattern + ", printout=" + printout + "]";
+    return "ClassPatternRule [glob=" + glob + ", message=" + message + "]";
   }
 
 }
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java b/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
index 73d16044..a35cb6eb 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ClassScanner.java
@@ -119,7 +119,7 @@ String checkClassUse(Type type, String what, boolean deep) {
     final String binaryClassName = type.getClassName();
     for (final ClassPatternRule r : forbiddenClassPatterns) {
       if (r.matches(binaryClassName)) {
-        return String.format(Locale.ENGLISH, "Forbidden %s use: %s", what, r.printout);
+        return String.format(Locale.ENGLISH, "Forbidden %s use: %s", what, r.getPrintout(binaryClassName));
       }
     }
     if (deep && forbidNonPortableRuntime) {
diff --git a/src/test/antunit/TestInlineSignatures.xml b/src/test/antunit/TestInlineSignatures.xml
index cad7d365..6dae0ef7 100644
--- a/src/test/antunit/TestInlineSignatures.xml
+++ b/src/test/antunit/TestInlineSignatures.xml
@@ -37,8 +37,8 @@
         java.lang.** @ You are crazy that you disallow all java.lang
       </forbiddenapis>
     </au:expectfailure>
-    <au:assertLogContains level="error" text="java.util.Array* [You are crazy that you disallow all Array*]"/> 
-    <au:assertLogContains level="error" text="java.lang.** [You are crazy that you disallow all java.lang]"/> 
+    <au:assertLogContains level="error" text="java.util.ArrayList [You are crazy that you disallow all Array*]"/> 
+    <au:assertLogContains level="error" text="java.lang.String [You are crazy that you disallow all java.lang]"/> 
   </target>
   
   <target name="testForbiddenClassWithDefaultMessage">
diff --git a/src/test/antunit/TestInternalRuntimeCalls.xml b/src/test/antunit/TestInternalRuntimeCalls.xml
index 67ddfdf8..9a25303b 100644
--- a/src/test/antunit/TestInternalRuntimeCalls.xml
+++ b/src/test/antunit/TestInternalRuntimeCalls.xml
@@ -34,7 +34,7 @@
         <bundledsignatures name="jdk-internal-${jdk.version}"/>
       </forbiddenapis>
     </au:expectfailure>
-    <au:assertLogContains level="error" text="sun.** [non-public internal runtime class in Java ${jdk.version}]"/> 
+    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-public internal runtime class in Java ${jdk.version}]"/> 
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
   
diff --git a/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java b/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
index 3ca3bfff..a3b33853 100644
--- a/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
+++ b/src/test/java/de/thetaphi/forbiddenapis/CheckerSetupTest.java
@@ -58,7 +58,7 @@ public void testClassSignature() throws Exception {
   public void testClassPatternSignature() throws Exception {
     checker.parseSignaturesString("java.lang.** @ Foobar");
     assertEquals(Collections.emptyMap(), checker.forbiddenClasses);
-    assertEquals(Collections.singleton(new ClassPatternRule("java.lang.**", "java.lang.** [Foobar]")), checker.forbiddenClassPatterns);
+    assertEquals(Collections.singleton(new ClassPatternRule("java.lang.**", "Foobar")), checker.forbiddenClassPatterns);
     assertEquals(Collections.emptyMap(), checker.forbiddenFields);
     assertEquals(Collections.emptyMap(), checker.forbiddenMethods);
   }

From e151f43e6528c1a94992c5d976d7e0022ba8249c Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 00:32:32 +0100
Subject: [PATCH 09/14] Improve test

---
 src/test/antunit/TestInlineSignatures.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/test/antunit/TestInlineSignatures.xml b/src/test/antunit/TestInlineSignatures.xml
index 6dae0ef7..555b7661 100644
--- a/src/test/antunit/TestInlineSignatures.xml
+++ b/src/test/antunit/TestInlineSignatures.xml
@@ -39,6 +39,8 @@
     </au:expectfailure>
     <au:assertLogContains level="error" text="java.util.ArrayList [You are crazy that you disallow all Array*]"/> 
     <au:assertLogContains level="error" text="java.lang.String [You are crazy that you disallow all java.lang]"/> 
+    <au:assertLogContains level="error" text="java.lang.StringBuilder [You are crazy that you disallow all java.lang]"/> 
+    <au:assertLogContains level="error" text="java.lang.Object [You are crazy that you disallow all java.lang]"/> 
   </target>
   
   <target name="testForbiddenClassWithDefaultMessage">

From 2376a37ad03fc935e6f3babe59398260d40626ea Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 00:48:21 +0100
Subject: [PATCH 10/14] Make test pass with non-Oracle / Java 9 runtime

---
 src/test/antunit/TestInternalRuntimeCalls.xml | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/test/antunit/TestInternalRuntimeCalls.xml b/src/test/antunit/TestInternalRuntimeCalls.xml
index 9a25303b..2480add1 100644
--- a/src/test/antunit/TestInternalRuntimeCalls.xml
+++ b/src/test/antunit/TestInternalRuntimeCalls.xml
@@ -16,7 +16,11 @@
 -->
 <project xmlns:au="antlib:org.apache.ant.antunit">
 
-  <target name="testNonPortableSignatures">
+  <condition property="has.sunmisc">
+    <available classname="sun.misc.BASE64Encoder"/>
+  </condition>
+  
+  <target name="testNonPortableSignatures" if="has.sunmisc">
     <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
       <forbiddenapis failOnMissingClasses="false">
         <file file="OracleInternalRuntime.class"/>
@@ -27,25 +31,26 @@
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
   
-  <target name="testInternalSignatures">
+  <target name="testDeprecatedInternalRuntimeForbidden" if="has.sunmisc">
     <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
-      <forbiddenapis failOnMissingClasses="false">
+      <forbiddenapis internalRuntimeForbidden="true" failOnMissingClasses="false">
         <file file="OracleInternalRuntime.class"/>
-        <bundledsignatures name="jdk-internal-${jdk.version}"/>
       </forbiddenapis>
     </au:expectfailure>
-    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-public internal runtime class in Java ${jdk.version}]"/> 
+    <au:assertLogContains level="warn" text="The setting 'internalRuntimeForbidden' was deprecated"/> 
+    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
   
-  <target name="testDeprecatedInternalRuntimeForbidden">
+  <!-- this should work also with non-Oracle runtimes, as no heuristics: -->
+  <target name="testInternalSignatures">
     <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
-      <forbiddenapis internalRuntimeForbidden="true" failOnMissingClasses="false">
+      <forbiddenapis failOnMissingClasses="false">
         <file file="OracleInternalRuntime.class"/>
+        <bundledsignatures name="jdk-internal-${jdk.version}"/>
       </forbiddenapis>
     </au:expectfailure>
-    <au:assertLogContains level="warn" text="The setting 'internalRuntimeForbidden' was deprecated"/> 
-    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
+    <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-public internal runtime class in Java ${jdk.version}]"/> 
     <au:assertLogContains level="error" text=" 2 error(s)"/> 
   </target>
   

From 56189706b45fbdb052019830ce52bf3b329ae252 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 11:19:58 +0100
Subject: [PATCH 11/14] rename jdk-nonportable to jdk-non-portable to be
 consistent with jdk-system-out

---
 build.xml                                                 | 2 +-
 src/main/docs/ant-task.html                               | 4 ++--
 src/main/docs/bundled-signatures.html                     | 2 +-
 src/main/java/de/thetaphi/forbiddenapis/Constants.java    | 2 +-
 src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java  | 4 ++--
 .../thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java | 6 +++---
 .../thetaphi/forbiddenapis/maven/AbstractCheckMojo.java   | 4 ++--
 src/test/antunit/TestCli.xml                              | 2 +-
 src/test/antunit/TestDeprecatedTask.xml                   | 2 +-
 src/test/antunit/TestFinalJAR.xml                         | 8 ++++----
 src/test/antunit/TestInternalRuntimeCalls.xml             | 2 +-
 src/test/antunit/pom-generator.xsl                        | 4 ++--
 src/test/gradle/build.gradle                              | 2 +-
 13 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/build.xml b/build.xml
index 1f450664..28e8d854 100644
--- a/build.xml
+++ b/build.xml
@@ -470,7 +470,7 @@
       <signatures>
         <bundled name="jdk-unsafe-${jdk.version}"/>
         <bundled name="jdk-deprecated-${jdk.version}"/>
-        <bundled name="jdk-nonportable"/>
+        <bundled name="jdk-non-portable"/>
         <bundled name="jdk-system-out"/>
         <bundled name="jdk-reflection"/>
       </signatures>
diff --git a/src/main/docs/ant-task.html b/src/main/docs/ant-task.html
index e4874004..2b070acc 100644
--- a/src/main/docs/ant-task.html
+++ b/src/main/docs/ant-task.html
@@ -120,8 +120,8 @@ <h2>Parameters</h2>
   <td>internalRuntimeForbidden</td>
   <td><code>boolean</code></td>
   <td><code>false</code></td>
-  <td>Forbids calls to non-portable runtime APIs (like <code>sun.misc.Unsafe</code>). <em>Please note:</em> This enables <code>"jdk-nonportable"</code> bundled signatures for backwards compatibility.<br>
-  <strong>Deprecated.</strong> Use <a href="bundled-signatures.html">bundled signatures</a> <code>"jdk-nonportable"</code> or <code>"jdk-internal"</code> instead.</td>
+  <td>Forbids calls to non-portable runtime APIs (like <code>sun.misc.Unsafe</code>). <em>Please note:</em> This enables <code>"jdk-non-portable"</code> bundled signatures for backwards compatibility.<br>
+  <strong>Deprecated.</strong> Use <a href="bundled-signatures.html">bundled signatures</a> <code>"jdk-non-portable"</code> or <code>"jdk-internal"</code> instead.</td>
 </tr>
 
 <tr>
diff --git a/src/main/docs/bundled-signatures.html b/src/main/docs/bundled-signatures.html
index 4a1aa078..8540466c 100644
--- a/src/main/docs/bundled-signatures.html
+++ b/src/main/docs/bundled-signatures.html
@@ -38,7 +38,7 @@ <h1>Bundled Signatures Documentation</h1>
 Calling those methods will always trigger security manager and is completely forbidden from Java 9 on
 (for Java <tt>*</tt> = 1.6, 1.7, 1.8; Maven / Gradle automatically add the compile Java version, <em>since forbiddenapis v2.1</em>).</li>
 
-<li><strong><tt>jdk-nonportable</tt>:</strong> Signatures of all non-portable (like <code>com.sun.management.HotSpotDiagnosticMXBean</code>)
+<li><strong><tt>jdk-non-portable</tt>:</strong> Signatures of all non-portable (like <code>com.sun.management.HotSpotDiagnosticMXBean</code>)
 or internal runtime APIs (like <code>sun.misc.Unsafe</code>). This is a superset of <tt>jdk-internal</tt>.<br>
 <em>Internally this is implemented using heuristics:</em> Any reference to an API that is part of the Java runtime (<tt>rt.jar</tt>, extensions,
 Java 9 <tt>java.*</tt> / <tt>jdk.*</tt> core modules) and is <strong>not</strong> part of the Java SE specification packages
diff --git a/src/main/java/de/thetaphi/forbiddenapis/Constants.java b/src/main/java/de/thetaphi/forbiddenapis/Constants.java
index 89fed26b..25ac2f79 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/Constants.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/Constants.java
@@ -22,7 +22,7 @@
 
 public interface Constants {
 
-  final String BS_JDK_NONPORTABLE = "jdk-nonportable";
+  final String BS_JDK_NONPORTABLE = "jdk-non-portable";
   
   final String DEPRECATED_WARN_INTERNALRUNTIME = String.format(Locale.ENGLISH,
       "The setting 'internalRuntimeForbidden' was deprecated and will be removed in next version. For backwards compatibility task/mojo is using '%s' bundled signatures instead.", BS_JDK_NONPORTABLE);
diff --git a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
index f63a2fc0..b1f01f5e 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/ant/AntTask.java
@@ -325,9 +325,9 @@ public void setFailOnUnresolvableSignatures(boolean failOnUnresolvableSignatures
 
   /**
    * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
-   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
+   * <em>Please note:</em> This enables {@code "jdk-non-portable"} bundled signatures for backwards compatibility.
    * Defaults to {@code false}. 
-   * @deprecated Use bundled signatures {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
+   * @deprecated Use bundled signatures {@code "jdk-non-portable"} or {@code "jdk-internal"} instead.
    */
   @Deprecated
   public void setInternalRuntimeForbidden(boolean internalRuntimeForbidden) {
diff --git a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
index 9fff75a1..03b8886b 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/gradle/CheckForbiddenApis.java
@@ -220,9 +220,9 @@ public void setBundledSignatures(Set<String> bundledSignatures) {
 
   /**
    * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
-   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
+   * <em>Please note:</em> This enables {@code "jdk-non-portable"} bundled signatures for backwards compatibility.
    * Defaults to {@code false}. 
-   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
+   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-non-portable"} or {@code "jdk-internal"} instead.
    */
   @Deprecated
   @Input
@@ -231,7 +231,7 @@ public boolean getInternalRuntimeForbidden() {
   }
 
   /** @see #getInternalRuntimeForbidden
-   * @deprecated Use bundled signatures {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
+   * @deprecated Use bundled signatures {@code "jdk-non-portable"} or {@code "jdk-internal"} instead.
    */
   @Deprecated
   public void setInternalRuntimeForbidden(boolean internalRuntimeForbidden) {
diff --git a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
index e2cb15f0..1761c648 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/maven/AbstractCheckMojo.java
@@ -114,8 +114,8 @@ public abstract class AbstractCheckMojo extends AbstractMojo implements Constant
 
   /**
    * Forbids calls to non-portable runtime APIs (like {@code sun.misc.Unsafe}).
-   * <em>Please note:</em> This enables {@code "jdk-nonportable"} bundled signatures for backwards compatibility.
-   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-nonportable"} or {@code "jdk-internal"} instead.
+   * <em>Please note:</em> This enables {@code "jdk-non-portable"} bundled signatures for backwards compatibility.
+   * @deprecated Use <a href="bundled-signatures.html">bundled signatures</a> {@code "jdk-non-portable"} or {@code "jdk-internal"} instead.
    * @since 1.0
    */
   @Deprecated
diff --git a/src/test/antunit/TestCli.xml b/src/test/antunit/TestCli.xml
index 285bdc33..44f64c5c 100644
--- a/src/test/antunit/TestCli.xml
+++ b/src/test/antunit/TestCli.xml
@@ -25,7 +25,7 @@
       <arg value="-d"/>
       <arg file="${antunit.main.classes}"/>
       <arg value="-b"/>
-      <arg value="jdk-unsafe-${jdk.version},jdk-deprecated-${jdk.version},jdk-nonportable"/>
+      <arg value="jdk-unsafe-${jdk.version},jdk-deprecated-${jdk.version},jdk-non-portable"/>
     </java>
     <au:assertLogContains text=" 0 error(s)."/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-deprecated-${jdk.version}"/> 
diff --git a/src/test/antunit/TestDeprecatedTask.xml b/src/test/antunit/TestDeprecatedTask.xml
index be853274..40251e7e 100644
--- a/src/test/antunit/TestDeprecatedTask.xml
+++ b/src/test/antunit/TestDeprecatedTask.xml
@@ -23,7 +23,7 @@
       <fileset dir="${antunit.main.classes}"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
-      <bundledsignatures name="jdk-nonportable"/>
+      <bundledsignatures name="jdk-non-portable"/>
     </forbiddenapis-deprecated>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
     <au:assertLogContains level="warn" text="DEPRECATED-WARNING"/> 
diff --git a/src/test/antunit/TestFinalJAR.xml b/src/test/antunit/TestFinalJAR.xml
index 32dfbbe2..a633fe3f 100644
--- a/src/test/antunit/TestFinalJAR.xml
+++ b/src/test/antunit/TestFinalJAR.xml
@@ -23,7 +23,7 @@
       <fileset dir="${antunit.main.classes}"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
-      <bundledsignatures name="jdk-nonportable"/>
+      <bundledsignatures name="jdk-non-portable"/>
     </forbiddenapis-jar>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
@@ -32,7 +32,7 @@
     <forbiddenapis-jar dir="${antunit.main.classes}" classpathref="path.all">
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
-      <bundledsignatures name="jdk-nonportable"/>
+      <bundledsignatures name="jdk-non-portable"/>
     </forbiddenapis-jar>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
@@ -42,7 +42,7 @@
     <fa:forbiddenapis xmlns:fa="antlib:de.thetaphi.forbiddenapis" dir="${antunit.main.classes}" classpathref="path.all">
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
-      <bundledsignatures name="jdk-nonportable"/>
+      <bundledsignatures name="jdk-non-portable"/>
     </fa:forbiddenapis>
     <au:assertLogContains level="info" text=" 0 error(s)."/> 
   </target>
@@ -59,7 +59,7 @@
       <zipfileset src="${jar-file}" excludes="de/thetaphi/forbiddenapis/commons/cli/**"/>
       <bundledsignatures name="jdk-unsafe-${jdk.version}"/>
       <bundledsignatures name="jdk-deprecated-${jdk.version}"/>
-      <bundledsignatures name="jdk-nonportable"/>
+      <bundledsignatures name="jdk-non-portable"/>
       <classpath>
         <pathelement path="${jar-file}"/>
         <path refid="path.main-build"/>
diff --git a/src/test/antunit/TestInternalRuntimeCalls.xml b/src/test/antunit/TestInternalRuntimeCalls.xml
index 2480add1..95dafb56 100644
--- a/src/test/antunit/TestInternalRuntimeCalls.xml
+++ b/src/test/antunit/TestInternalRuntimeCalls.xml
@@ -24,7 +24,7 @@
     <au:expectfailure expectedMessage="Check for forbidden API calls failed, see log">
       <forbiddenapis failOnMissingClasses="false">
         <file file="OracleInternalRuntime.class"/>
-        <bundledsignatures name="jdk-nonportable"/>
+        <bundledsignatures name="jdk-non-portable"/>
       </forbiddenapis>
     </au:expectfailure>
     <au:assertLogContains level="error" text="sun.misc.BASE64Encoder [non-portable or internal runtime class]"/> 
diff --git a/src/test/antunit/pom-generator.xsl b/src/test/antunit/pom-generator.xsl
index c816a988..f1ee380a 100644
--- a/src/test/antunit/pom-generator.xsl
+++ b/src/test/antunit/pom-generator.xsl
@@ -51,7 +51,7 @@
               <bundledSignatures>
                 <bundledSignature>jdk-unsafe</bundledSignature>
                 <bundledSignature>jdk-deprecated</bundledSignature>
-                <bundledSignature>jdk-nonportable</bundledSignature>
+                <bundledSignature>jdk-non-portable</bundledSignature>
                 <bundledSignature>jdk-system-out</bundledSignature>
               </bundledSignatures>
               <signatures>${antunit.signatures}</signatures>
@@ -84,5 +84,5 @@
       </dependencies>
     </project>
   </xsl:template>
-	
+  
 </xsl:stylesheet>
diff --git a/src/test/gradle/build.gradle b/src/test/gradle/build.gradle
index 2bdecc5e..397e526f 100644
--- a/src/test/gradle/build.gradle
+++ b/src/test/gradle/build.gradle
@@ -32,7 +32,7 @@ apply plugin: 'de.thetaphi.forbiddenapis'
 sourceCompatibility = forbiddenSourceCompatibility
 
 forbiddenApis {
-  bundledSignatures = [ 'jdk-unsafe', 'jdk-deprecated', 'jdk-nonportable' ]
+  bundledSignatures = [ 'jdk-unsafe', 'jdk-deprecated', 'jdk-non-portable' ]
   failOnUnsupportedJava = false
 }
 

From f47a8bbe233f59837a5e3d15a11b993c425a8544 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 12:07:46 +0100
Subject: [PATCH 12/14] Add more checks to test

---
 src/test/antunit/TestCli.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/test/antunit/TestCli.xml b/src/test/antunit/TestCli.xml
index 44f64c5c..51b23f20 100644
--- a/src/test/antunit/TestCli.xml
+++ b/src/test/antunit/TestCli.xml
@@ -30,6 +30,7 @@
     <au:assertLogContains text=" 0 error(s)."/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-deprecated-${jdk.version}"/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-unsafe-${jdk.version}"/> 
+    <au:assertLogContains text="Reading bundled API signatures: jdk-non-portable"/> 
   </target>
 
   <target name="testIncludesExcludes">
@@ -52,6 +53,8 @@
     <au:assertLogContains text="Reading bundled API signatures: jdk-deprecated-${jdk.version}"/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-unsafe-${jdk.version}"/> 
     <au:assertLogContains text="Reading bundled API signatures: jdk-system-out"/> 
+    <au:assertLogContains text="Reading bundled API signatures: jdk-non-portable"/> 
+    <au:assertLogContains text="WARNING: The setting 'internalRuntimeForbidden' was deprecated"/> 
   </target>
 
   <target name="testSuppressAnnotations">

From b8b2313d3ed3320ed3b3830981679f2be8e95c09 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 12:22:24 +0100
Subject: [PATCH 13/14] Add more docs

---
 src/main/docs/bundled-signatures.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/main/docs/bundled-signatures.html b/src/main/docs/bundled-signatures.html
index 8540466c..ac00e211 100644
--- a/src/main/docs/bundled-signatures.html
+++ b/src/main/docs/bundled-signatures.html
@@ -43,7 +43,8 @@ <h1>Bundled Signatures Documentation</h1>
 <em>Internally this is implemented using heuristics:</em> Any reference to an API that is part of the Java runtime (<tt>rt.jar</tt>, extensions,
 Java 9 <tt>java.*</tt> / <tt>jdk.*</tt> core modules) and is <strong>not</strong> part of the Java SE specification packages
 (mainly <tt>java</tt>, <tt>javax</tt>, but also <tt>org.ietf.jgss</tt>, <tt>org.omg</tt>, <tt>org.w3c.dom</tt>, and <tt>org.xml.sax</tt>) is forbidden
-(any java version, no specific JDK version, <em>since forbiddenapis v2.1</em>).</li>
+(any java version, no specific JDK version, <em>since forbiddenapis v2.1 / replaces deprecated and wrong-named task
+setting <tt>internalRuntimeForbidden</tt></em>).</li>
 
 <li><strong><tt>jdk-system-out</tt>:</strong> On server-side applications or libraries used by other programs, printing to
 <tt>System.out</tt> or <tt>System.err</tt> is discouraged and should be avoided (any java version, no specific JDK version).</li>

From 3ca52e439ecb3706029c3378df10fc7fe62b8919 Mon Sep 17 00:00:00 2001
From: Uwe Schindler <uwe@thetaphi.de>
Date: Tue, 29 Dec 2015 12:39:34 +0100
Subject: [PATCH 14/14] Use URI to get decoded patch before extracting module
 name

---
 .../de/thetaphi/forbiddenapis/AsmUtils.java   | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
index 103aeb2b..59783b94 100644
--- a/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
+++ b/src/main/java/de/thetaphi/forbiddenapis/AsmUtils.java
@@ -16,6 +16,7 @@
  * limitations under the License.
  */
 
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.util.Locale;
 import java.util.regex.Pattern;
@@ -129,16 +130,21 @@ public static String getModuleName(URL jrtUrl) {
     if (!"jrt".equalsIgnoreCase(jrtUrl.getProtocol())) {
       return null;
     }
-    String mod = jrtUrl.getPath();
-    if (mod != null && mod.length() >= 1) {
-      mod = mod.substring(1);
-      int p = mod.indexOf('/');
-      if (p >= 0) {
-        mod = mod.substring(0, p);
+    try {
+      // use URI class to also decode path and remove escapes:
+      String mod = jrtUrl.toURI().getPath();
+      if (mod != null && mod.length() >= 1) {
+        mod = mod.substring(1);
+        int p = mod.indexOf('/');
+        if (p >= 0) {
+          mod = mod.substring(0, p);
+        }
+        return mod.isEmpty() ? null : mod;
       }
-      return mod.isEmpty() ? null : mod;
+      return null;
+    } catch (URISyntaxException use) {
+      return null;
     }
-    return null;
   }
 
 }