Bug 64186

Summary: Decrease usage of ThreadLocals in XML Signature API
Product: POI Reporter: Andreas Beeker <kiwiwings>
Component: OPCAssignee: POI Developers List <dev>
Severity: enhancement    
Priority: P2    
Version: 4.1.x-dev   
Target Milestone: ---   
Hardware: All   
OS: All   

Description Andreas Beeker 2020-03-01 21:58:56 UTC
When implementing the DSign API, I thought I put all the configuration options into SignatureConfig, also this class was designed with dependency injection in mind. To cope with the per document configuration, I've introduced ThreadLocals.

I think this is a design flaw, as the ThreadLocals seldom get cleared again and so I would like to move the per document configuration into SignatureInfo.

I couldn't keep the internal API stable, but the usercode side should be stable till POI 5.0. The code still contains the ThreadLocals, but when the usercodes migrates to using SignatureInfo instead, the ThreadLocals stay left uninitialized.
Comment 1 Andreas Beeker 2020-03-01 23:26:47 UTC
applied via r1874671
Comment 2 Dominik Stadler 2020-03-02 06:56:17 UTC
Please note that we provide org.apache.poi.util.ThreadLocalUtil#clearAllThreadLocals() to allow users to clear any leftover ThreadLocals in Threads, e.g. before they are returned to a thread-pool. 

Maybe we should also clear these until we can remove them completely?