Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-platform Commit: 8fb8ef4f9e30027be25ce2a8e8044aebd69066d7 https://github.com/xwiki/xwiki-platform/commit/8fb8ef4f9e30027be25ce2a8e8044... Author: Michael Hamann <[email protected]> Date: 2026-09-16 (Wed, 16 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java M xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java Log Message: ----------- XWIKI-24875: Trusted domains aren't updated after wiki descriptor change * remove the nullable return of maybeInitializeWithDomain(), reported by Sonar as a possible NPE (java:S2259): the method re-read URLConfiguration#isTrustedDomainsEnabled() even though isDomainTrusted() had just checked it, so the two reads could disagree and return null to a caller that doesn't expect it. The flag is now checked by the callers and the method, renamed to initializeWithDomain(), always returns the set. The only other caller, parseToSafeURI(String, String), discarded the return value anyway. * suppress java:S3077 on the trustedDomains field with a comment explaining why volatile is both necessary and sufficient here: the only mutation of the field is the wholesale replacement of the supplier by invalidateCache(), and both the memoizing supplier and the ConcurrentHashMap key set it computes are thread-safe on their own. * cover the case of parseToSafeURI(String, String) with trusted domains disabled, which wasn't tested before. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> (cherry picked from commit 72be05a450758edfdcbac1b135a35a23a4f5f964) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications