Name: js151677 Date: 04/23/2004


A DESCRIPTION OF THE PROBLEM :
SubjectCodeSource.implies(CodeSource) does a blind cast of the retrieved Principal to PrincipalComparator, and then catches the exception if thrown. This can get quite expensive if your Subject has more than one Principal.

Please inspect the SubjectCodeSource.implies(CodeSource) method.

 From JDK 1.4.2_03 src.jar, com.sun.security.auth.SubjectCodeSource, line 188:
 
        Class principalComparator = Class.forName(pppe.principalClass,
             true,
             sysClassLoader);
        Constructor c = principalComparator.getConstructor(PARAMS);
        PrincipalComparator pc =
            (PrincipalComparator)c.newInstance
          (new Object[] { pppe.principalName });
        ...
    } catch (Exception e) {
           // no PrincipalComparator, simply compare Principals
          if (subjectList == null) {

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
implies should use the instanceof operator to check if the retrieved Object is a PrincipalComparator
ACTUAL -
Throws excessive ClassCastExceptions


(Incident Review ID: 255354)
======================================================================