Bug 49483 - KeyResolver.registerAtStart() leads to ClassCastException
KeyResolver.registerAtStart() leads to ClassCastException
Status: RESOLVED FIXED
Product: Security - Now in JIRA
Classification: Unclassified
Component: Encryption
unspecified
PC Windows NT
: P2 normal
: ---
Assigned To: XML Security Developers Mailing List
:
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2010-06-21 18:17 UTC by Clement Pellerin
Modified: 2010-07-21 13:27 UTC (History)
0 users



Attachments
source code patch (5.07 KB, patch)
2010-06-21 18:17 UTC, Clement Pellerin
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Clement Pellerin 2010-06-21 18:17:37 UTC
Created attachment 25627 [details]
source code patch

KeyResolver.registerAtStart() adds a String to KeyResolver._resolverVector.
In ResolverIterator.next(), we expect the items in _resolverVector to be KeyResolver instances and this causes a ClassCastException.

To reproduce, run this code:
KeyResolver.registerAtStart("org.apache.xml.security.test.encryption.BobKeyResolver");
KeyResolverSpi resolver = (KeyResolverSpi)KeyResolver.iterator().next();

The solution is to call new KeyResolver(className) just like KeyResolver.register().
Unfortunately, we cannot add the throws clauses. For backwards compatibility,  we return an unchecked RuntimeException instead. We chose IllegalArgumentException.

We also modify ResolverIterator.remove() to throw an UnsupportedOperationException.

I did not add a junit for this bug because there is no way to remove a KeyResolver once it is registered. This would affect the subsequent tests.
Comment 1 coheigea 2010-06-23 13:41:59 UTC
Patch applied, thanks.

Colm.
Comment 2 coheigea 2010-06-30 10:12:28 UTC
Hi Clement,

A problem with this patch is that it is not compatible with JDK 1.4:

    [javac] symbol  : constructor IllegalArgumentException (java.lang.String,java.lang.Exception)
    [javac] location: class java.lang.IllegalArgumentException
    [javac]            throw new IllegalArgumentException("Invalid KeyResolver class name", ex);
    [javac]                  ^
    [javac] 1 error

Colm.
Comment 3 sean.mullan 2010-07-02 09:11:44 UTC
(In reply to comment #2)
> Hi Clement,
> 
> A problem with this patch is that it is not compatible with JDK 1.4:
> 
>     [javac] symbol  : constructor IllegalArgumentException
> (java.lang.String,java.lang.Exception)
>     [javac] location: class java.lang.IllegalArgumentException
>     [javac]            throw new IllegalArgumentException("Invalid KeyResolver
> class name", ex);
>     [javac]                  ^
>     [javac] 1 error
> 
> Colm.

You can make that compatible with 1.4 as follows:

throw (IllegalArgumentException) new 
       IllegalArgumentException("Invalid KeyResolver class name").initCause(ex);
Comment 4 coheigea 2010-07-21 13:27:36 UTC
Fix applied thanks Sean!

Colm.