[mboapache]

Identity-key construction gated on an allowlist; Class.forName no longer initializes unvetted classes

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[clr-apache]

I do not believe that we need a new constant to allow arbitrary classes to be used as ObjectIdentity.
We can simplify this by allowing the standard identity classes that are shipped with JDO or a user-specified object identity class named in the metadata.

[mboapache]

I agree with Craig's commet. Altough it is a backward compatibility issue to remove support for arbitrary classes to be used as ObjectIdentity, I also think this is not a problem in practice. People will use classes like LongIdentity or StringIdentity or come up with their own ObjectId class and then there is no problem.

[mboapache]

This pull request no longer relevant, superseeded by PR# 142