Stop using ValidationSecurityManager as SecurityManager (#1983)

The Security Manager is deprecated and subject to removal in a future release. There is no replacement for the Security Manager.

See also #1579

Co-authored-by: Kengo TODA <skypencil@gmail.com>

CHANGELOG.md

@@ -11,6 +11,7 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 ### Fixed
 - Bumped Saxon-HE from 10.6 to 11.3 ([#1955](https://github.com/spotbugs/spotbugs/pull/1955), [#1999](https://github.com/spotbugs/spotbugs/pull/1999))
 - Fixed traversal of nested archives governed by `-nested:true` ([#1930](https://github.com/spotbugs/spotbugs/pull/1930))
+- Warnings of deprecated System::setSecurityManager calls on Java 17 ([#1983](https://github.com/spotbugs/spotbugs/pull/1983))
 - Fixed false positive SSD bug for locking on java.lang.Class objects ([#1978](https://github.com/spotbugs/spotbugs/issues/1978))
 - Bump ObjectWeb ASM from 9.2 to 9.3 supporting JDK 19 ([#2004](https://github.com/spotbugs/spotbugs/pull/2004))
 

spotbugs/src/main/java/edu/umd/cs/findbugs/ba/jsr305/TypeQualifierValue.java

@@ -148,15 +148,6 @@ private TypeQualifierValue(ClassDescriptor typeQualifier, @CheckForNull Object v
                 try {
                     Global.getAnalysisCache().getClassAnalysis(ClassData.class, checkerName);
 
-                    // found it.
-                    SecurityManager m = System.getSecurityManager();
-                    if (m == null) {
-                        if (DEBUG_CLASSLOADING) {
-                            System.out.println("Setting ValidationSecurityManager");
-                        }
-                        System.setSecurityManager(ValidationSecurityManager.INSTANCE);
-                    }
-
                     Class<?> c = ValidatorClassLoader.INSTANCE.loadClass(checkerName.getDottedClassName());
                     if (TypeQualifierValidator.class.isAssignableFrom(c)) {
 
@@ -187,14 +178,6 @@ private TypeQualifierValue(ClassDescriptor typeQualifier, @CheckForNull Object v
                     AnalysisContext.logError("Unable to construct type qualifier checker " + checkerName + " due to "
                             + e.getClass().getSimpleName() + ":" + e.getMessage());
                 }
-            } else if (DEBUG_CLASSLOADING) {
-                SecurityManager m = System.getSecurityManager();
-                if (m == null) {
-                    if (DEBUG_CLASSLOADING) {
-                        System.out.println("Setting ValidationSecurityManager");
-                    }
-                    System.setSecurityManager(ValidationSecurityManager.INSTANCE);
-                }
             }
         }
         this.validator = validator1;
@@ -269,7 +252,7 @@ public When validate(@CheckForNull Object constantValue) {
         Profiler profiler = analysisCache.getProfiler();
         profiler.start(validator.getClass());
         try {
-            return ValidationSecurityManager.sandboxedValidation(proxy, validator, constantValue);
+            return validator.forConstantValue(proxy, constantValue);
         } catch (Exception e) {
             AnalysisContext.logError("Error executing custom validator for " + typeQualifier + " " + constantValue, e);
             return When.UNKNOWN;