[jira] [Updated] (JCR-5260) Uncaught non-RepositoryException types in HTTP responses break JCR clients

["Julian Reschke (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/JCR-5260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Julian Reschke updated JCR-5260:
--------------------------------
    Security:     (was: Private)

> Uncaught non-RepositoryException types in HTTP responses break JCR clients
> --------------------------------------------------------------------------
>
>                 Key: JCR-5260
>                 URL: https://issues.apache.org/jira/browse/JCR-5260
>             Project: Jackrabbit Content Repository
>          Issue Type: Improvement
>          Components: jackrabbit-jcr2dav
>            Reporter: Julian Reschke
>            Assignee: Julian Reschke
>            Priority: Minor
>
> The WebDAV remoting layer currently marshals arbitrary Java exceptions into HTTP response payloads instead of restricting them strictly to javax.jcr.RepositoryException and its subclasses.
> Why this breaks clients expecting javax.jcr.RepositoryException:
> Clients only have JCR and Jackrabbit client JARs on their classpath. If the server serializes a server-only exception, client deserialization fails with ClassNotFoundException, hiding the real cause.
> Client code expects to catch javax.jcr.RepositoryException. Unmapped runtime exceptions bypass these catch blocks and cause unexpected application crashes.
> Serializing arbitrary exceptions exposes internal server stack traces and dependency details over the wire.
> Client compatibility becomes tied to the server's internal classpath and library dependencies.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)