[jboss-jira] [JBoss JIRA] Closed: (JBREM-488) SSLSocketBuilder.getKeyStore destroys keyPassword

[David Lloyd (JIRA)]

     [ http://jira.jboss.com/jira/browse/JBREM-488?page=all ]

David Lloyd closed JBREM-488.
-----------------------------


> SSLSocketBuilder.getKeyStore destroys keyPassword
> -------------------------------------------------
>
>                 Key: JBREM-488
>                 URL: http://jira.jboss.com/jira/browse/JBREM-488
>             Project: JBoss Remoting
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: transport, security
>    Affects Versions: 1.4.2 final, 1.4.3.GA
>            Reporter: Scott M Stark
>         Assigned To: Tom  Elrod
>
> The following SSLSocketBuilder code ends up overwriting a valid keyPassword because of the if(keyPassword == null || keyPassword.length > 0)  statement:
> 431 	   private KeyStore getKeyStore(URL storeURL) throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException 	
> 432 	   { 	
> 433 	      KeyStore keyStore = KeyStore.getInstance(keyStoreType); 	
> 434 	      if(storeURL == null) 	
> 435 	      { 	
> 436 	         throw new IOException("Can not create SSL Server Socket Factory due to the url to the key store not being set."); 	
> 437 	      } 	
> 438 	      InputStream is = storeURL.openStream(); 	
> 439 	      keyStore.load(is, keyStorePassword); 	
> 440 		
> 441 	      // if key password not set, just try the key store password 	
> 442 	      if(keyPassword == null || keyPassword.length > 0) 	
> 443 	      { 	
> 444 	         keyPassword = keyStorePassword; 	
> 445 	      } 	
> 446 		
> 447 	      return keyStore; 	
> 448 		
> 449 	   }
> It should be if(keyPassword == null || keyPassword.length == 0)

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira