-
Bug
-
Resolution: Fixed
-
P4
-
1.2.1
-
None
-
beta
-
generic
-
generic
The following anomalities were found in policy files parsing:
1) The syntax of the "grant" entry in policy files is:
grant codebase "SOME-BASE" signedby "ALIASES LIST" {...}
The PolicyParser class allows multiple codebase &
signedby clauses in the same grant entry, and disregards all
but the last ones. It should throw a ParsingException instead.
The place to catch this condition is in the parseGrantEntry
method of the PolicyParser class.
2) In the signedBy "ALIASES LIST" clause of the grant entry, if
a string like the following is supplied: "ALIAS1, ,ALIAS2",
the grant entry is ignored (which is o.k.) but no ParsingException
is thrown. It should be thrown, since a string of spaces is not
a legal alias. What happens instead, is that the string of spaces
is considered a legal alias, and since no such alias is ever found
in the keystore - the grant entry is disregarded.
The signedBy string is parsed in the getCerticiates method of
the PolicyFile class. This function should check for this
condition and throw an exception.
1) The syntax of the "grant" entry in policy files is:
grant codebase "SOME-BASE" signedby "ALIASES LIST" {...}
The PolicyParser class allows multiple codebase &
signedby clauses in the same grant entry, and disregards all
but the last ones. It should throw a ParsingException instead.
The place to catch this condition is in the parseGrantEntry
method of the PolicyParser class.
2) In the signedBy "ALIASES LIST" clause of the grant entry, if
a string like the following is supplied: "ALIAS1, ,ALIAS2",
the grant entry is ignored (which is o.k.) but no ParsingException
is thrown. It should be thrown, since a string of spaces is not
a legal alias. What happens instead, is that the string of spaces
is considered a legal alias, and since no such alias is ever found
in the keystore - the grant entry is disregarded.
The signedBy string is parsed in the getCerticiates method of
the PolicyFile class. This function should check for this
condition and throw an exception.