fix(server): reject security check on JDK 24+

JDK 24 removed the Security Manager (JEP 486), so
'-Djava.security.manager=allow' is a fatal VM initialization error and
System.setSecurityManager() always throws. Fail the launcher with an
actionable message instead of a cryptic VM error, and keep the
security-disabled path unchanged.

Also assert a positive downstream signal in the launcher success and
security-disabled tests, so an unrelated failure such as a missing
bootstrap class can no longer pass, and report the underlying cause when
bootstrap validation fails.

Author: bitflicker64

hugegraph-server/hugegraph-dist/src/assembly/static/bin/hugegraph-server.sh

@@ -64,6 +64,10 @@ ensure_path_writable "$PLUGINS"
 MAX_MEM=$((32 * 1024))
 MIN_MEM=$((1 * 512))
 MIN_JAVA_VERSION=11
+# JDK 24 removed the Security Manager (JEP 486): "-Djava.security.manager=allow"
+# is a fatal VM initialization error there and System.setSecurityManager() always
+# throws, so HugeSecurityManager cannot be installed on newer runtimes.
+MAX_SECURITY_JAVA_VERSION=23
 
 # Add the slf4j-log4j12 binding
 CP=$(find -L $LIB -name 'log4j-slf4j-impl*.jar' | sort | tr '\n' ':')
@@ -144,6 +148,19 @@ esac
 JVM_OPTIONS="-Dlog4j.configurationFile=${CONF}/log4j2.xml"
 SECURITY_MANAGER_OPTION=""
 if [[ ${OPEN_SECURITY_CHECK} == "true" ]]; then
+    if [[ ${JAVA_VERSION} -gt ${MAX_SECURITY_JAVA_VERSION} ]]; then
+        SECURITY_UNSUPPORTED_MSG=$(cat <<EOF
+The security check requires Java ${MIN_JAVA_VERSION}-${MAX_SECURITY_JAVA_VERSION}, current is ${JAVA_VERSION}.
+JDK 24+ removed the Security Manager (JEP 486), so HugeSecurityManager can no longer be installed.
+Run the server on Java ${MAX_SECURITY_JAVA_VERSION} or lower, or start it with the security check
+disabled: 'start-hugegraph.sh -s false'.
+EOF
+)
+        echo "${SECURITY_UNSUPPORTED_MSG}" >&2
+        echo "${SECURITY_UNSUPPORTED_MSG}" >> "${OUTPUT}"
+        exit 1
+    fi
+
     SECURITY_PROPERTIES="${CONF}/java-security.properties"
     JVM_OPTIONS="${JVM_OPTIONS} \
                  -Djava.security.properties=${SECURITY_PROPERTIES}"

hugegraph-server/hugegraph-dist/src/assembly/travis/test-java-security-properties.sh

@@ -111,6 +111,19 @@ assert_invalid_security_properties() {
     fi
 }
 
+# The bootstrap only hands over to HugeGraphServer once the DNS TTL check and
+# the HugeSecurityManager installation have both succeeded, so this downstream
+# configuration failure is a positive signal instead of merely a nonzero exit.
+assert_reached_server_startup() {
+    local error_file="$1"
+    local message="$2"
+    grep -Fq "Failed to load yaml config file" "$error_file" || fail "$message"
+    grep -Fq "org.apache.hugegraph.bootstrap.HugeGraphServerBootstrap.main" \
+             "$error_file" || fail "$message"
+    grep -Fq "org.apache.hugegraph.dist.HugeGraphServer.main" \
+             "$error_file" || fail "$message"
+}
+
 assert_clean_bootstrap_error() {
     local error_file="$1"
     if grep -Eq 'Log4j|NetUtils|UnknownHost|hostname' "$error_file"; then
@@ -215,6 +228,8 @@ assert_launcher_accepts_security_properties() {
                 "$error_file"; then
         fail "launcher rejected valid Java security properties"
     fi
+    assert_reached_server_startup "$error_file" \
+        "valid Java security properties did not reach server startup"
 }
 
 assert_launcher_skips_security_validation() {
@@ -230,6 +245,8 @@ assert_launcher_skips_security_validation() {
     if grep -Fq "networkaddress.cache.ttl must load" "$error_file"; then
         fail "disabled launcher unexpectedly validated DNS TTL"
     fi
+    assert_reached_server_startup "$error_file" \
+        "disabled security check did not reach server startup"
 }
 
 ACTUAL_TTL=$("$JAVA_BIN" \
@@ -381,6 +398,34 @@ if [[ "$LAST_SECURITY_MANAGER_ARGUMENT" != \
     fail "operator option overrode the JDK 18+ security manager allowance"
 fi
 
+JDK23_CAPTURE="${TEMP_DIR}/jdk23.args"
+CAPTURE_FILE="$JDK23_CAPTURE" JAVA_HOME="$MOCK_JAVA_HOME" \
+    MOCK_JAVA_VERSION=23 STDOUT_MODE=true "$SERVER_SCRIPT" \
+    "${CONF}/gremlin-server.yaml" "${CONF}/rest-server.properties" true >/dev/null
+
+assert_argument "-Djava.security.manager=allow" "$JDK23_CAPTURE"
+assert_argument \
+    "-Djava.security.properties=${SECURITY_PROPERTIES}" "$JDK23_CAPTURE"
+
+JDK24_ERROR="${TEMP_DIR}/jdk24.err"
+if JAVA_HOME="$MOCK_JAVA_HOME" MOCK_JAVA_VERSION=24 STDOUT_MODE=true \
+   "$SERVER_SCRIPT" "${CONF}/gremlin-server.yaml" \
+   "${CONF}/rest-server.properties" true >/dev/null 2>"$JDK24_ERROR"; then
+    fail "launcher accepted a security-enabled JDK 24 runtime"
+fi
+grep -Fq "JDK 24+ removed the Security Manager" "$JDK24_ERROR" ||
+    fail "launcher did not explain the JDK 24 security incompatibility"
+
+JDK24_DISABLED_CAPTURE="${TEMP_DIR}/jdk24-disabled.args"
+CAPTURE_FILE="$JDK24_DISABLED_CAPTURE" JAVA_HOME="$MOCK_JAVA_HOME" \
+    MOCK_JAVA_VERSION=24 STDOUT_MODE=true "$SERVER_SCRIPT" \
+    "${CONF}/gremlin-server.yaml" "${CONF}/rest-server.properties" false \
+    >/dev/null
+
+assert_no_argument '^-Djava\.security\.manager=' "$JDK24_DISABLED_CAPTURE"
+assert_no_argument '^-Djava\.security\.properties=' "$JDK24_DISABLED_CAPTURE"
+assert_argument "false" "$JDK24_DISABLED_CAPTURE"
+
 DISABLED_CAPTURE="${TEMP_DIR}/disabled.args"
 CAPTURE_FILE="$DISABLED_CAPTURE" JAVA_HOME="$MOCK_JAVA_HOME" \
     STDOUT_MODE=true "$SERVER_SCRIPT" \

hugegraph-server/hugegraph-dist/src/main/java/org/apache/hugegraph/bootstrap/HugeGraphServerBootstrap.java

@@ -39,10 +39,10 @@ public static void main(String[] args) throws Exception {
             try {
                 validateDnsCacheTtl(
                         Security.getProperty("networkaddress.cache.ttl"));
-            } catch (Throwable ignored) {
+            } catch (Throwable e) {
                 System.err.println("ERROR: Java security property " +
                                    "networkaddress.cache.ttl must load as a " +
-                                   "finite positive integer");
+                                   "finite positive integer: " + e);
                 System.exit(1);
                 return;
             }
@@ -54,9 +54,9 @@ public static void main(String[] args) throws Exception {
                     throw new IllegalStateException(
                             "Unexpected security manager");
                 }
-            } catch (Throwable ignored) {
+            } catch (Throwable e) {
                 System.err.println("ERROR: Failed to install " +
-                                   "HugeSecurityManager");
+                                   "HugeSecurityManager: " + e);
                 System.exit(1);
                 return;
             }