From 8f9bab53385f66bfabe50132170c078e1faf0267 Mon Sep 17 00:00:00 2001
From: Konrad Windszus <kwin@apache.org>
Date: Wed, 5 Apr 2023 18:05:35 +0200
Subject: [PATCH] Enable forbiddenapis in Maven build

The detects issues like JCRVLT-702
---
 parent/pom.xml     | 62 ++++++++++++++++++++++++++++++++++++++++++++++
 vault-core/pom.xml | 13 ++++++++++
 2 files changed, 75 insertions(+)

diff --git a/parent/pom.xml b/parent/pom.xml
index c234714ab..8f59a9424 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -346,6 +346,68 @@ Bundle-Category: jackrabbit
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <version>3.5.1</version>
+                <configuration>
+                    <!--
+                      if the used Java version is too new,
+                      don't fail, just do nothing:
+                    -->
+                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
+                    <bundledSignatures>
+                        <!--
+                          This will automatically choose the right
+                          signatures based on 'maven.compiler.target':
+                        -->
+                        <bundledSignature>jdk-unsafe</bundledSignature>
+                        <bundledSignature>jdk-deprecated</bundledSignature>
+                        <!-- disallow undocumented classes like sun.misc.Unsafe: -->
+                        <bundledSignature>jdk-non-portable</bundledSignature>
+                        <!-- don't allow unsafe reflective access: -->
+                        <bundledSignature>jdk-reflection</bundledSignature>
+                    </bundledSignatures>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <version>3.5.1</version>
+                <configuration>
+                    <!--
+                      if the used Java version is too new,
+                      don't fail, just do nothing:
+                    -->
+                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
+                    <bundledSignatures>
+                        <!--
+                          This will automatically choose the right
+                          signatures based on 'maven.compiler.target':
+                        -->
+                        <bundledSignature>jdk-unsafe</bundledSignature>
+                        <bundledSignature>jdk-deprecated</bundledSignature>
+                        <!-- disallow undocumented classes like sun.misc.Unsafe: -->
+                        <bundledSignature>jdk-non-portable</bundledSignature>
+                        <!-- don't allow unsafe reflective access: -->
+                        <bundledSignature>jdk-reflection</bundledSignature>
+                    </bundledSignatures>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
 
     </build>
diff --git a/vault-core/pom.xml b/vault-core/pom.xml
index bd0de6e1e..7e897ad34 100644
--- a/vault-core/pom.xml
+++ b/vault-core/pom.xml
@@ -124,6 +124,19 @@
                 <groupId>biz.aQute.bnd</groupId>
                 <artifactId>bnd-resolver-maven-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <configuration>
+                    <excludes>
+                        <!-- excluded embedded 3rd party libraries -->
+                        <exclude>com/ctc/wstx/**/*.class</exclude>
+                        <exclude>org/apache/jackrabbit/jcr2spi/**/*.class</exclude>
+                        <exclude>org/codehaus/stax/**/*.class</exclude>
+                        <exclude>org/h2/**/*.class</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
         </plugins>
     </build>