[jira] [Updated] (JCR-5260) DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (Uncaught non-RepositoryException types in HTTP responses break JCR clients)

["Julian Reschke (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/JCR-5260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Julian Reschke updated JCR-5260:
--------------------------------
    Summary: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (Uncaught non-RepositoryException types in HTTP responses break JCR clients)  (was: Uncaught non-RepositoryException types in HTTP responses break JCR clients)

> DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (Uncaught non-RepositoryException types in HTTP responses break JCR clients)
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: JCR-5260
>                 URL: https://issues.apache.org/jira/browse/JCR-5260
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-jcr2dav
>    Affects Versions: 2.20.17, 2.22.4, 2.23.5
>            Reporter: Julian Reschke
>            Assignee: Julian Reschke
>            Priority: Critical
>             Fix For: 2.20.18, 2.23.6, 2.22.5
>
>
> The WebDAV remoting layer currently marshals arbitrary Java exceptions into HTTP response payloads instead of restricting them strictly to javax.jcr.RepositoryException and its subclasses.
> Why this breaks clients expecting javax.jcr.RepositoryException:
> Clients only have JCR and Jackrabbit client JARs on their classpath. If the server serializes a server-only exception, client deserialization fails with ClassNotFoundException, hiding the real cause.
> Client code expects to catch javax.jcr.RepositoryException. Unmapped runtime exceptions bypass these catch blocks and cause unexpected application crashes.
> Serializing arbitrary exceptions exposes internal server stack traces and dependency details over the wire.
> Client compatibility becomes tied to the server's internal classpath and library dependencies.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)