You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by "seanjmullan (via GitHub)" <gi...@apache.org> on 2026/07/06 16:45:36 UTC
[PR] PGPData fixes [santuario-xml-security-java]
seanjmullan opened a new pull request, #627:
URL: https://github.com/apache/santuario-xml-security-java/pull/627
Fix bit masking issue when checking. Check for invalid key packets when unmarshalling PGPData from XML.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] PGPData fixes [santuario-xml-security-java]
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan merged PR #627:
URL: https://github.com/apache/santuario-xml-security-java/pull/627
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] PGPData fixes [santuario-xml-security-java]
Posted by "seanjmullan (via GitHub)" <gi...@apache.org>.
seanjmullan commented on PR #627:
URL: https://github.com/apache/santuario-xml-security-java/pull/627#issuecomment-4916370450
> Possible issue:
>
> ```
> checkKeyPacket throws IllegalArgumentException (unchecked), while the XML constructor is declared [public DOMPGPData(Element pdElem) throws MarshalException]. That mismatch creates an API contract problem: any caller that only catches [MarshalException] to handle all XML-constructor failures will let the IllegalArgumentException escape silently.
>
> Required fix: wrap the call inside the XML constructor to honour its own declared contract:
> ```
It's not necessary as the exception is later caught and wrapped in a `MarshalException` at the two public entry points for unmarshalling:
- https://github.com/apache/santuario-xml-security-java/blob/42526995105c61ccd604672e400cc7819821b8dc/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMKeyInfoFactory.java#L183
- https://github.com/apache/santuario-xml-security-java/blob/42526995105c61ccd604672e400cc7819821b8dc/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMXMLSignatureFactory.java#L227
However, I did improve the test to check that the cause of the `MarshalException` is an `IllegalArgumentException`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@santuario.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org