refactor: forbiddenapis

pom.xml

@@ -443,6 +443,51 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>de.thetaphi</groupId>
+        <artifactId>forbiddenapis</artifactId>
+        <version>3.8</version>
+        <configuration>
+          <!--
+            if the used Java version is too new,
+            don't fail, just do nothing:
+          -->
+          <failOnUnsupportedJava>false</failOnUnsupportedJava>
+          <!--
+            If a class is missing while parsing signatures files, all methods
+            and fields from this class are silently ignored. This is useful
+            in multi-module Maven projects where only some modules have the
+            dependency to which the signature file(s) apply.
+
+            This settings prints no warning at all, so verify the signatures
+            at least once with full dependencies.
+          -->
+<!--          <ignoreSignaturesOfMissingClasses>true</ignoreSignaturesOfMissingClasses>-->
+          <bundledSignatures>
+            <!--
+              This will automatically choose the right
+              signatures based on 'maven.compiler.target':
+            -->
+<!--            <bundledSignature>jdk-unsafe</bundledSignature>-->
+<!--            <bundledSignature>jdk-deprecated</bundledSignature>-->
+            <!-- disallow undocumented classes like sun.misc.Unsafe: -->
+            <bundledSignature>jdk-non-portable</bundledSignature>
+            <!-- don't allow unsafe reflective access: -->
+            <bundledSignature>jdk-reflection</bundledSignature>
+          </bundledSignatures>
+<!--          <signaturesFiles>-->
+<!--            <signaturesFile>./rel/path/to/signatures.txt</signaturesFile>-->
+<!--          </signaturesFiles>-->
+        </configuration>
+        <executions>
+          <execution>
+            <goals>
+              <goal>check</goal>
+              <goal>testCheck</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
     <pluginManagement>
       <plugins>

tobago-core/src/main/java/org/apache/myfaces/tobago/convert/DurationConverter.java

@@ -28,12 +28,10 @@
 import jakarta.faces.context.FacesContext;
 import jakarta.faces.convert.Converter;
 import jakarta.faces.convert.ConverterException;
-
 import java.lang.invoke.MethodHandles;
-import java.text.DecimalFormat;
-import java.text.NumberFormat;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Locale;
 import java.util.StringTokenizer;
 
 /**
@@ -81,7 +79,6 @@ public String getAsString(
     final double factor = getUnitFactor(component);
     aDouble = aDouble * factor;
 
-    final NumberFormat format = new DecimalFormat("00");
     long value = Double.valueOf(aDouble).longValue();
     final int seconds = (int) (value % 60);
     value = value / 60;
@@ -90,11 +87,11 @@ public String getAsString(
     final String string;
     if (value > 0) {
       string = (negative ? "-" : "") + value + ":"
-          + format.format(minutes) + ":"
-          + format.format(seconds);
+          + String.format(Locale.ROOT, "%02d", minutes) + ":"
+          + String.format(Locale.ROOT, "%02d", seconds);
     } else {
       string = (negative ? "-" : "") + minutes + ":"
-          + format.format(seconds);
+          + String.format(Locale.ROOT, "%02d", seconds);
     }
     LOG.debug("string = '{}'", string);
     return string;

tobago-core/src/main/java/org/apache/myfaces/tobago/internal/renderkit/renderer/ToastsRenderer.java

@@ -19,8 +19,6 @@
 
 package org.apache.myfaces.tobago.internal.renderkit.renderer;
 
-import jakarta.faces.component.UIComponent;
-import jakarta.faces.context.FacesContext;
 import org.apache.myfaces.tobago.application.Toast;
 import org.apache.myfaces.tobago.component.Facets;
 import org.apache.myfaces.tobago.context.Markup;
@@ -45,6 +43,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
 import java.io.IOException;
 import java.lang.invoke.MethodHandles;
 import java.time.LocalTime;

tobago-core/src/main/java/org/apache/myfaces/tobago/layout/Measure.java

@@ -25,6 +25,7 @@
 
 import java.io.Serializable;
 import java.lang.invoke.MethodHandles;
+import java.util.Locale;
 
 /**
  * In PDLs the class {@link org.apache.myfaces.tobago.layout.MeasureEditor} will convert the string literals.
@@ -113,7 +114,7 @@ public static Measure valueOf(final String s, final Unit defaultUnit) {
       for (int i = 4; i >= 2; i--) {
         final int pos = length - i;
         if (length >= i && Character.isLetter(s.charAt(pos))) {
-          return new Measure(s.substring(0, pos), Unit.valueOf(s.substring(pos).toUpperCase()));
+          return new Measure(s.substring(0, pos), Unit.valueOf(s.substring(pos).toUpperCase(Locale.ROOT)));
         }
       }
       return new Measure(s, defaultUnit);
@@ -214,7 +215,7 @@ public enum Unit {
     private final String value;
 
     Unit() {
-      value = name().equals("PERCENT") ? "%" : name().toLowerCase();
+      value = name().equals("PERCENT") ? "%" : name().toLowerCase(Locale.ROOT);
     }
 
     String getValue() {

tobago-core/src/main/java/org/apache/myfaces/tobago/model/SuggestFilter.java

@@ -19,6 +19,8 @@
 
 package org.apache.myfaces.tobago.model;
 
+import java.util.Locale;
+
 public enum SuggestFilter {
 
   all,
@@ -30,13 +32,13 @@ public enum SuggestFilter {
   public static final String CONTAINS = "contains";
 
   public String getValue() {
-    return name().toLowerCase();
+    return name().toLowerCase(Locale.ROOT);
   }
 
   public static SuggestFilter parse(final String string) {
     if (string == null) {
       return null;
     }
-    return valueOf(string.toUpperCase());
+    return valueOf(string.toUpperCase(Locale.ROOT));
   }
 }

tobago-core/src/main/java/org/apache/myfaces/tobago/renderkit/css/Icons.java

@@ -23,6 +23,7 @@
 import org.slf4j.LoggerFactory;
 
 import java.lang.invoke.MethodHandles;
+import java.util.Locale;
 import java.util.regex.Pattern;
 
 /**
@@ -62,7 +63,7 @@ public enum Icons implements CssItem {
   private final String clazz;
 
   Icons() {
-    this.clazz = "bi-" + name().toLowerCase().replaceAll("_", "-");
+    this.clazz = "bi-" + name().toLowerCase(Locale.ROOT).replaceAll("_", "-");
   }
 
   @Override

tobago-core/src/main/java/org/apache/myfaces/tobago/util/DebugPhaseListener.java

@@ -31,10 +31,10 @@
 import jakarta.faces.event.PhaseListener;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-
 import java.lang.invoke.MethodHandles;
 import java.text.MessageFormat;
 import java.util.Iterator;
+import java.util.Locale;
 import java.util.Map;
 
 public class DebugPhaseListener implements PhaseListener {
@@ -84,10 +84,14 @@ public void afterPhase(final PhaseEvent phaseEvent) {
         for (final Iterator<FacesMessage> messageIterator
              = facesContext.getMessages(clientId); messageIterator.hasNext(); ) {
           final FacesMessage msg = messageIterator.next();
-          LOG.info(MessageFormat.format("Faces message found."
-                  + "\n  Component: {0} \n  Severity : {1}"
-                  + "\n  Summary  : {2} \n  Detail   : {3}",
-              clientId, msg.getSeverity(), msg.getSummary(), msg.getDetail()));
+          MessageFormat messageFormat = new MessageFormat("""
+              Faces message found.
+                Component: {0}
+                Severity : {1}
+                Summary  : {2}
+                Detail   : {3}""", Locale.ROOT);
+          LOG.info(messageFormat.format(new Object[]{
+              clientId, msg.getSeverity(), msg.getSummary(), msg.getDetail()}));
         }
       }
     }

tobago-core/src/test/java/org/apache/myfaces/tobago/internal/config/TobagoConfigParserUnitTest.java

@@ -32,6 +32,7 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 
@@ -176,7 +177,7 @@ public void testUniqueness() throws IllegalAccessException {
     // check hash code values
     for (final Field field : fields) {
       final int hash = field.getInt(dummy);
-      final String name = field.getName().toLowerCase().replace('_', '-');
+      final String name = field.getName().toLowerCase(Locale.ROOT).replace('_', '-');
       Assertions.assertEquals(name.hashCode(), hash, "Are the constants correct?");
     }
   }

tobago-core/src/test/java/org/apache/myfaces/tobago/internal/renderkit/renderer/RendererTestBase.java

@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.stream.Collectors;
@@ -43,7 +44,7 @@ protected String loadHtml(final String fileName) throws IOException {
       if (is == null) {
         throw new FileNotFoundException(fileName);
       }
-      try (InputStreamReader isr = new InputStreamReader(is);
+      try (InputStreamReader isr = new InputStreamReader(is, StandardCharsets.UTF_8);
            BufferedReader reader = new BufferedReader(isr)) {
         final String xml = reader.lines().collect(Collectors.joining(System.lineSeparator()))
             .replaceAll("<!--[^>]*-->", "")

tobago-core/src/test/java/org/apache/myfaces/tobago/renderkit/html/AriasUnitTest.java

@@ -23,6 +23,7 @@
 import org.junit.jupiter.api.Test;
 
 import java.lang.reflect.Field;
+import java.util.Locale;
 
 public class AriasUnitTest {
 
@@ -36,7 +37,7 @@ public void testAttributeNames() throws IllegalAccessException {
 
       final String extension = value.substring("aria-".length());
       final String name = field.getName();
-      Assertions.assertEquals(name, extension.toUpperCase());
+      Assertions.assertEquals(name, extension.toUpperCase(Locale.ROOT));
     }
   }
 

tobago-core/src/test/java/org/apache/myfaces/tobago/renderkit/html/DataAttributesUnitTest.java

@@ -22,6 +22,8 @@
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 
+import java.util.Locale;
+
 public class DataAttributesUnitTest {
 
   @Test
@@ -41,7 +43,7 @@ public void testAttributeNames() throws IllegalAccessException {
           ? value.substring("data-tobago-".length())
           : value.substring("data-".length());
       final String name = d.name();
-      Assertions.assertEquals(name, extension.toUpperCase().replaceAll("-", "_"));
+      Assertions.assertEquals(name, extension.toUpperCase(Locale.ROOT).replaceAll("-", "_"));
     }
   }
 }

tobago-core/src/test/java/org/apache/myfaces/tobago/renderkit/html/HtmlElementsUnitTest.java

@@ -28,6 +28,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Locale;
 
 public class HtmlElementsUnitTest {
 
@@ -39,10 +40,10 @@ public void testNames() throws IllegalAccessException {
       final String value = element.getValue();
       Assertions.assertEquals(
           value,
-          element.name().toLowerCase().replaceAll("_", "-"),
+          element.name().toLowerCase(Locale.ROOT).replaceAll("_", "-"),
           "Check to lower: '" + element + "'");
       Assertions.assertEquals(
-          value.toUpperCase().replaceAll("-", "_"),
+          value.toUpperCase(Locale.ROOT).replaceAll("-", "_"),
           element.name(),
           "Check to upper: '" + element + "'");
     }

tobago-example/tobago-example-demo/src/main/java/org/apache/myfaces/tobago/example/demo/AstroData.java

@@ -30,6 +30,7 @@
 import javax.swing.tree.DefaultMutableTreeNode;
 import java.io.InputStreamReader;
 import java.io.Serializable;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -53,7 +54,7 @@ public class AstroData implements Serializable {
   public AstroData() {
 
     final InputStreamReader reader
-        = new InputStreamReader(AstroData.class.getResourceAsStream("astro-data.json"));
+        = new InputStreamReader(AstroData.class.getResourceAsStream("astro-data.json"), StandardCharsets.UTF_8);
 
     Gson gson = new GsonBuilder().create();
     dataList = gson.fromJson(reader, new TypeToken<ArrayList<SolarObject>>() {

tobago-example/tobago-example-demo/src/main/java/org/apache/myfaces/tobago/example/demo/CategoryTree.java

@@ -26,6 +26,7 @@
 
 import javax.swing.tree.DefaultMutableTreeNode;
 import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
 
 public class CategoryTree {
 
@@ -34,8 +35,8 @@ private CategoryTree() {
 
   public static DefaultMutableTreeNode createSample() {
 
-    final InputStreamReader reader
-        = new InputStreamReader(AstroData.class.getResourceAsStream("category-tree.json"));
+    final InputStreamReader reader = new InputStreamReader(
+        AstroData.class.getResourceAsStream("category-tree.json"), StandardCharsets.UTF_8);
 
     final Gson gson = new GsonBuilder().create();
     final CategoryNode node = gson.fromJson(reader, new TypeToken<CategoryNode>() {

tobago-example/tobago-example-demo/src/main/java/org/apache/myfaces/tobago/example/demo/CurrentValueController.java

@@ -21,9 +21,9 @@
 
 import jakarta.enterprise.context.RequestScoped;
 import jakarta.inject.Named;
-
 import java.time.LocalDate;
 import java.util.Currency;
+import java.util.Locale;
 
 @Named
 @RequestScoped
@@ -41,7 +41,7 @@ public CurrentValueController() {
   }
 
   public String toUpperCase(final String text) {
-    return text != null ? text.toUpperCase() : null;
+    return text != null ? text.toUpperCase(Locale.ROOT) : null;
   }
 
   public LocalDate plus50(final LocalDate base) {

tobago-example/tobago-example-demo/src/main/java/org/apache/myfaces/tobago/example/demo/EventController.java

@@ -82,12 +82,12 @@
 import jakarta.faces.event.AjaxBehaviorEvent;
 import jakarta.faces.event.ValueChangeEvent;
 import jakarta.inject.Named;
-
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Date;
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
 import java.util.TreeSet;
 
@@ -241,7 +241,7 @@ public static class EventsOnComponent implements Serializable {
 
     EventsOnComponent(final UIComponentBase component) {
       final String simpleName = component.getClass().getSimpleName();
-      tagName = simpleName.substring(2, 3).toLowerCase() + simpleName.substring(3);
+      tagName = simpleName.substring(2, 3).toLowerCase(Locale.ROOT) + simpleName.substring(3);
       if (component.getEventNames() != null) {
         this.eventNames.addAll(component.getEventNames());
       }

tobago-example/tobago-example-demo/src/main/java/org/apache/myfaces/tobago/example/demo/InputSuggestController.java

@@ -30,11 +30,11 @@
 import jakarta.faces.component.UIInput;
 import jakarta.faces.model.SelectItem;
 import jakarta.inject.Named;
-
 import java.io.Serializable;
 import java.lang.invoke.MethodHandles;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Locale;
 
 @SessionScoped
 @Named
@@ -166,7 +166,7 @@ private List<AutoSuggestItem> getSuggestItems(final String prefix, final boolean
           items.add(item);
         }
       } else {
-        if (dataRow[2].toLowerCase().startsWith(prefix.toLowerCase())) {
+        if (dataRow[2].toLowerCase(Locale.ROOT).startsWith(prefix.toLowerCase(Locale.ROOT))) {
           final AutoSuggestItem item = new AutoSuggestItem();
           item.setLabel(dataRow[0]);
           item.setValue(dataRow[2]);