From db98ec0bd9b20d0fac9c6b02222942560e86a917 Mon Sep 17 00:00:00 2001
From: Dominik Stadler <centic@apache.org>
Date: Sun, 8 Nov 2015 10:01:48 +0000
Subject: [PATCH] Tried to add excelant to forbidden-apis-check, but failed due
 to issue #82 in forbidden-api-checks tool. List more pathes that we still not
 include. Add description to custom forbidden-api-checks and add commented out
 checks for reflectoin as discussed in bug 58597

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713218 13f79535-47bb-0310-9956-ffa450edef68
---
 build.xml                                     | 35 +++++++++++++------
 .../devtools/forbidden-signatures.txt         | 14 +++++---
 2 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/build.xml b/build.xml
index 92945e318..a82dc75cc 100644
--- a/build.xml
+++ b/build.xml
@@ -1767,19 +1767,32 @@ under the License.
         <forbiddenapis 
                  internalRuntimeForbidden="true" 
                  classpathref="javadoc.classpath"
-    			 suppressAnnotation="org.apache.poi.util.SuppressForbidden"
-        	>
+                 suppressAnnotation="org.apache.poi.util.SuppressForbidden"
+            >
             <bundledsignatures name="jdk-unsafe-${jdk.version.source}"/>
             <bundledsignatures name="jdk-deprecated-${jdk.version.source}"/>
-        	<signaturesFileset file="src/resources/devtools/forbidden-signatures.txt"/>
-        	<fileset dir="${main.output.dir}"/>
-        	<fileset dir="${scratchpad.output.dir}"/>
-        	<fileset dir="${ooxml.output.dir}"/>
-        	<fileset dir="${main.output.test.dir}"/>
-        	<fileset dir="${ooxml.output.test.dir}"/>
-        	<!--
-        	<fileset dir="${scratchpad.output.test.dir}"/>
-        	-->
+            <!-- 
+            <bundledsignatures name="jdk-system-out"/>
+            -->
+            <signaturesFileset file="src/resources/devtools/forbidden-signatures.txt"/>
+            <!-- sources -->
+            <fileset dir="${main.output.dir}"/>
+            <fileset dir="${ooxml.output.dir}"/>
+            <fileset dir="${scratchpad.output.dir}"/>
+            <!--
+            Adding Excelant causes ClassNotFoundException, see https://github.com/policeman-tools/forbidden-apis/issues/85
+            <fileset dir="${excelant.output.dir}"/>
+            -->
+            <!--
+            <fileset dir="${examples.output.dir}"/>
+            -->
+            <!-- test-sources -->
+            <fileset dir="${main.output.test.dir}"/>
+            <fileset dir="${ooxml.output.test.dir}"/>
+            <!--
+            <fileset dir="${scratchpad.output.test.dir}"/>
+            <fileset dir="${excelant.output.test.dir}"/>
+            -->
         </forbiddenapis>
     </target>
 
diff --git a/src/resources/devtools/forbidden-signatures.txt b/src/resources/devtools/forbidden-signatures.txt
index e002a1a17..1d9dbfcc7 100644
--- a/src/resources/devtools/forbidden-signatures.txt
+++ b/src/resources/devtools/forbidden-signatures.txt
@@ -20,7 +20,13 @@
 @ignoreUnresolvable
 @defaultMessage POI forbidden APIs
 
-java.util.Locale#getDefault()
-java.util.Locale#setDefault(java.util.Locale)
-java.util.TimeZone#getDefault()
-java.util.Date#toString()
\ No newline at end of file
+# Locale related interfaces which we want to avoid to not have code which depends on the locale of the current machine
+java.util.Locale#getDefault() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+java.util.Locale#setDefault(java.util.Locale) @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+java.util.TimeZone#getDefault() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+java.util.Date#toString() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+
+# disabled as there are still invocations that we could not remove easily
+#java.lang.reflect.AccessibleObject#setAccessible(java.lang.reflect.AccessibleObject[], boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9
+#java.lang.reflect.AccessibleObject#setAccessible(boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9
+#java.lang.reflect.Method#invoke(java.lang.Object, java.lang.Object[]) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9