Address review comments 2

Author: KostasTsiounis

closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java

@@ -23,7 +23,6 @@
  */
 package openj9.internal.security;
 
-import java.lang.StackWalker.Option;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -162,6 +161,21 @@ private RestrictedSecurity() {
         super();
     }
 
+    /**
+      * Check loaded profiles' hash values.
+      *
+      * In order to avoid unintentional changes in profiles and incentivize
+      * extending profiles, instead of altering them, a digest of the profile
+      * is calculated and compared to the expected value.
+      */
+     private static void checkHashValues() {
+        ProfileParser parser = profileParser;
+        if ((parser != null) && !isJarVerifierInStackTrace()) {
+            profileParser = null;
+            parser.checkHashValues();
+        }
+     }
+
     /**
      * Check if restricted security mode is enabled.
      *
@@ -231,11 +245,7 @@ public static boolean isFIPSEnabled() {
      */
     public static boolean isServiceAllowed(Service service) {
         if (securityEnabled) {
-            ProfileParser parser = profileParser;
-            if ((parser != null) && !isJarVerifierInStackTrace()) {
-                profileParser = null;
-                parser.checkHashValues();
-            }
+            checkHashValues();
             return restricts.isRestrictedServiceAllowed(service, true);
         }
         return true;
@@ -249,11 +259,7 @@ public static boolean isServiceAllowed(Service service) {
      */
     public static boolean canServiceBeRegistered(Service service) {
         if (securityEnabled) {
-            ProfileParser parser = profileParser;
-            if ((parser != null) && !isJarVerifierInStackTrace()) {
-                profileParser = null;
-                parser.checkHashValues();
-            }
+            checkHashValues();
             return restricts.isRestrictedServiceAllowed(service, false);
         }
         return true;
@@ -267,11 +273,7 @@ public static boolean canServiceBeRegistered(Service service) {
      */
     public static boolean isProviderAllowed(String providerName) {
         if (securityEnabled) {
-            ProfileParser parser = profileParser;
-            if ((parser != null) && !isJarVerifierInStackTrace()) {
-                profileParser = null;
-                parser.checkHashValues();
-            }
+            checkHashValues();
             // Remove argument, e.g. -NSS-FIPS, if present.
             int pos = providerName.indexOf('-');
             if (pos >= 0) {
@@ -291,11 +293,7 @@ public static boolean isProviderAllowed(String providerName) {
      */
     public static boolean isProviderAllowed(Class<?> providerClazz) {
         if (securityEnabled) {
-            ProfileParser parser = profileParser;
-            if ((parser != null) && !isJarVerifierInStackTrace()) {
-                profileParser = null;
-                parser.checkHashValues();
-            }
+            checkHashValues();
             String providerClassName = providerClazz.getName();
 
             // Check if the specified class extends java.security.Provider.
@@ -386,11 +384,11 @@ private static void getProfileID(Properties props) {
     }
 
     private static boolean isJarVerifierInStackTrace() {
-        return StackWalker.getInstance(Option.RETAIN_CLASS_REFERENCE)
-                          .walk(sf -> sf.map(s -> s.toStackTraceElement())
-                                        .anyMatch(s -> ("java.util.jar.JarVerifier".equals(s.getClassName())
-                                                            && "java.base".equals(s.getModuleName()))
-                                            )
+        return StackWalker.getInstance(StackWalker.Option.RETAIN_CLASS_REFERENCE)
+                          .walk(sf -> sf.map(s -> s.getDeclaringClass())
+                                        .anyMatch(s -> ("java.util.jar.JarVerifier".equals(s.getName())
+                                                         && "java.base".equals(s.getModule().getName()))
+                                                 )
                                );
     }