You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Kristian Waagan (JIRA)" <de...@db.apache.org> on 2005/12/07 14:55:10 UTC
[jira] Created: (DERBY-746) NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
-----------------------------------------------------------------------------------------------
Key: DERBY-746
URL: http://issues.apache.org/jira/browse/DERBY-746
Project: Derby
Type: Bug
Components: Security
Versions: 10.2.0.0, 10.1.1.2, 10.1.2.1, 10.1.3.0, 10.1.2.2
Environment: All environments.
Reporter: Kristian Waagan
Priority: Minor
When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
[To reproduce]
(connection string copied from test 'store/encryptionKey.sql' and then modified)
Supply the following connection string, for instance in ij:
connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
(deleted the last digit in the encryption key)
'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
(replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Resolved: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Andrew McIntyre (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Andrew McIntyre resolved DERBY-746:
-----------------------------------
Resolution: Fixed
Committed to 10.1 with revision 397972.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.0.0, 10.1.3.0, 10.1.2.4
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Closed: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Rick Hillegas (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Rick Hillegas closed DERBY-746.
-------------------------------
Resolution: Fixed
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.1.1.2, 10.1.2.1, 10.2.1.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assigned To: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.1.0, 10.1.3.0, 10.1.2.4
>
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Reopened: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan reopened DERBY-746:
-----------------------------------
Reopening to port to 10.1.3 maintenance release.
Merge commands, executed from the 10.1 branch directory:
svn merge -r 365784:365785 https://svn.apache.org/repos/asf/db/derby/code/trunk/
svn merge -r 367711:367712 https://svn.apache.org/repos/asf/db/derby/code/trunk/
I ran derbyall with JDK 1.5 (Solaris 10) and got 4 errors, of which I can account for 2 of them:
derbyall/derbynetclientmats/derbynetmats.fail:derbynet/dataSourcePermissions_net.java
derbyall/encryptionAll/encryptionAll.fail:store/aes.sql (due to JDK 1.5, ok with JDK 1.4)
derbyall/encryptionAll/encryptionAll.fail:store/encryptionKey.sql (ok, see DERBY-788)
derbyall/derbyall.fail:unit/T_Diagnosticable.unit
Don't think the other failures are related to the port, I see other people have gotten them as well.
Should DERBY-788 BE PORTED as well? It is only a test fix.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.0.0
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-746) NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan updated DERBY-746:
----------------------------------
Attachment: derby-746.diff
derby-746.stat
Stat and diff for the patch (against revision 365637).
No new files added.
Derbyall ran without errors 32 bit (chroot) Gentoo Linux (6 suites skipped - no db2jcc).
The test will fail on Solaris 10 with J2SE 5.0 due to another problem, see DERBY-788.
Patch description:
* JCECipherFactory.boot() now checks the output from the fromHexString-method and throws an exception if it is invalid, instead of failing with NPE.
* Added 2 new SQLStates and messages (only English)
* Added 2 new test cases (invalid char in encryption key and encryption key of with odd length).
* Updated master file.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Attachments: derby-746.diff, derby-746.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Reopened: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Rick Hillegas (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Rick Hillegas reopened DERBY-746:
---------------------------------
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.1.1.2, 10.1.2.1, 10.2.1.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assigned To: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.1.0, 10.1.3.0, 10.1.2.4
>
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Assigned: (DERBY-746) NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan reassigned DERBY-746:
-------------------------------------
Assign To: Kristian Waagan
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.2.0.0, 10.1.1.2, 10.1.2.1, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Rick Hillegas (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Rick Hillegas updated DERBY-746:
--------------------------------
Derby Info: (was: [Release Note Needed])
Toggling off "release note needed" because this patch went into 10.1.3 and was described there.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.1.1.2, 10.1.2.1, 10.2.1.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assigned To: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.1.0, 10.1.3.0, 10.1.2.4
>
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Closed: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan closed DERBY-746:
---------------------------------
Fix Version: 10.2.0.0
Resolution: Fixed
Spelling error fixed in revision 367712, thanks to Daniel John Debrunner.
Verified changes by inspection, closing the issue.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.2.0.0, 10.1.1.2, 10.1.2.1, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.0.0
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Closed: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan closed DERBY-746:
---------------------------------
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.0.0, 10.1.3.0, 10.1.2.4
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-746) NullPointerException when
'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan updated DERBY-746:
----------------------------------
Fix Version: 10.1.3.0
10.1.2.4
Derby Info: [Release Note Needed]
Set fix version to indicate porting.
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Fix For: 10.2.0.0, 10.1.3.0, 10.1.2.4
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Updated: (DERBY-746) NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
Posted by "Kristian Waagan (JIRA)" <de...@db.apache.org>.
[ http://issues.apache.org/jira/browse/DERBY-746?page=all ]
Kristian Waagan updated DERBY-746:
----------------------------------
Attachment: derby-746a.stat
derby-746a.diff
Original patch (derby-746.diff) applied to trunk revision 365785.
Sunhita Kambhampati pointed out a spelling error in the patch (thanks).
An *additional* patch fixing the error in the message file and the test master file is attached as derby-746a.diff.
I reran 'store/encryptionKey.sql' - no errors (Gentoo Linux, 64 bit, Sun JDK 1.4.2_10 Blackdown JDK 1.4.2-02 & IBM J9SE 2.2 (1.4.2)).
> NullPointerException when 'encryptionKey' length is an odd number, or it contains invalid chars
> -----------------------------------------------------------------------------------------------
>
> Key: DERBY-746
> URL: http://issues.apache.org/jira/browse/DERBY-746
> Project: Derby
> Type: Bug
> Components: Security
> Versions: 10.1.1.2, 10.1.2.1, 10.2.0.0, 10.1.3.0, 10.1.2.2
> Environment: All environments.
> Reporter: Kristian Waagan
> Assignee: Kristian Waagan
> Priority: Minor
> Attachments: derby-746.diff, derby-746.stat, derby-746a.diff, derby-746a.stat
>
> When booting/creating an encrypted database, a NullPointerException is thrown if the length of the connection string attribute 'encryptionKey' is an odd number, or the encryption key contains invalid characters for hexadecimal numbers (char not in the set [0-9a-fA-F]).
> The reason for the exception being thrown, is that the method 'iapi.util.StringUtil.fromHexString(String, int, int)' returns null for the cases described above. The code calling the method in 'JCECipherFactory.boot(boolean, Properties)' does not check that the return value is not null.
> A related trivial issue is that 'fromHexString' does not allow the caller to see the distinction between a string with invalid length and a string containing invalid characters (both cases return null).
> [To reproduce]
> (connection string copied from test 'store/encryptionKey.sql' and then modified)
> Supply the following connection string, for instance in ij:
> connect 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656';
> (deleted the last digit in the encryption key)
> 'jdbc:derby:encdbcbc_key;create=true;dataEncryption=true;encryptionAlgorithm=DES/CBC/NoPadding;encryptionKey=6162636465666768696162636465656X';
> (replaced last digit with an X)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira