Tried to add excelant to forbidden-apis-check, but failed due to issue #82 in forbidden-api-checks tool. List more pathes that we still not include. Add description to custom forbidden-api-checks and add commented out checks for reflectoin as discussed in bug 58597

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1713218 13f79535-47bb-0310-9956-ffa450edef68

build.xml

@@ -1771,14 +1771,27 @@ under the License.
             >
             <bundledsignatures name="jdk-unsafe-${jdk.version.source}"/>
             <bundledsignatures name="jdk-deprecated-${jdk.version.source}"/>
+            <!-- 
+            <bundledsignatures name="jdk-system-out"/>
+            -->
             <signaturesFileset file="src/resources/devtools/forbidden-signatures.txt"/>
+            <!-- sources -->
             <fileset dir="${main.output.dir}"/>
-        	<fileset dir="${scratchpad.output.dir}"/>
             <fileset dir="${ooxml.output.dir}"/>
+            <fileset dir="${scratchpad.output.dir}"/>
+            <!--
+            Adding Excelant causes ClassNotFoundException, see https://github.com/policeman-tools/forbidden-apis/issues/85
+            <fileset dir="${excelant.output.dir}"/>
+            -->
+            <!--
+            <fileset dir="${examples.output.dir}"/>
+            -->
+            <!-- test-sources -->
             <fileset dir="${main.output.test.dir}"/>
             <fileset dir="${ooxml.output.test.dir}"/>
             <!--
             <fileset dir="${scratchpad.output.test.dir}"/>
+            <fileset dir="${excelant.output.test.dir}"/>
             -->
         </forbiddenapis>
     </target>

src/resources/devtools/forbidden-signatures.txt

@@ -20,7 +20,13 @@
 @ignoreUnresolvable
 @defaultMessage POI forbidden APIs
 
-java.util.Locale#getDefault()
+# Locale related interfaces which we want to avoid to not have code which depends on the locale of the current machine
-java.util.Locale#setDefault(java.util.Locale)
+java.util.Locale#getDefault() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
-java.util.TimeZone#getDefault()
+java.util.Locale#setDefault(java.util.Locale) @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
-java.util.Date#toString()
+java.util.TimeZone#getDefault() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+java.util.Date#toString() @ Do not use methods that depend on the current Local, either use Locale.ROOT or let the user define the local, see class LocaleUtil for details
+
+# disabled as there are still invocations that we could not remove easily
+#java.lang.reflect.AccessibleObject#setAccessible(java.lang.reflect.AccessibleObject[], boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9
+#java.lang.reflect.AccessibleObject#setAccessible(boolean) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9
+#java.lang.reflect.Method#invoke(java.lang.Object, java.lang.Object[]) @ Reflection usage fails with SecurityManagers and likely will not work any more in Java 9