+ * JDK 1.5+ objects use KeyReps instead.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if ((key == null) || (key.length == 0)) {
+ throw new InvalidObjectException("key not deserializable");
+ }
+ this.key = key.clone();
+ if ((encodedKey == null) || (encodedKey.length == 0)) {
+ throw new InvalidObjectException(
+ "encoded key not deserializable");
+ }
+ this.encodedKey = encodedKey.clone();
+ }
}
diff --git a/jdk/src/share/classes/com/sun/crypto/provider/DHPublicKey.java b/jdk/src/share/classes/com/sun/crypto/provider/DHPublicKey.java
index 7293c945768..4e7d0f03ca0 100644
--- a/jdk/src/share/classes/com/sun/crypto/provider/DHPublicKey.java
+++ b/jdk/src/share/classes/com/sun/crypto/provider/DHPublicKey.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -40,15 +40,13 @@
* A public key in X.509 format for the Diffie-Hellman key agreement algorithm.
*
* @author Jan Luehe
- *
- *
* @see DHPrivateKey
* @see java.security.KeyAgreement
*/
final class DHPublicKey implements PublicKey,
javax.crypto.interfaces.DHPublicKey, Serializable {
- static final long serialVersionUID = 7647557958927458271L;
+ private static final long serialVersionUID = 7647557958927458271L;
// the public key
private BigInteger y;
@@ -60,10 +58,10 @@ final class DHPublicKey implements PublicKey,
private byte[] encodedKey;
// the prime modulus
- private BigInteger p;
+ private final BigInteger p;
// the base generator
- private BigInteger g;
+ private final BigInteger g;
// the private-value length (optional)
private int l;
@@ -320,4 +318,27 @@ private Object writeReplace() throws java.io.ObjectStreamException {
getFormat(),
getEncoded());
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * JDK 1.5+ objects use KeyReps instead.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if ((key == null) || (key.length == 0)) {
+ throw new InvalidObjectException("key not deserializable");
+ }
+ this.key = key.clone();
+ if ((encodedKey == null) || (encodedKey.length == 0)) {
+ throw new InvalidObjectException(
+ "encoded key not deserializable");
+ }
+ this.encodedKey = encodedKey.clone();
+ }
}
diff --git a/jdk/src/share/classes/com/sun/crypto/provider/PBEKey.java b/jdk/src/share/classes/com/sun/crypto/provider/PBEKey.java
index 7fb66e5597f..69c9d00e584 100644
--- a/jdk/src/share/classes/com/sun/crypto/provider/PBEKey.java
+++ b/jdk/src/share/classes/com/sun/crypto/provider/PBEKey.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@
package com.sun.crypto.provider;
+import java.io.IOException;
+import java.io.InvalidObjectException;
import java.security.MessageDigest;
import java.security.KeyRep;
import java.security.spec.InvalidKeySpecException;
@@ -41,11 +43,11 @@
*/
final class PBEKey implements SecretKey {
- static final long serialVersionUID = -2234768909660948176L;
+ private static final long serialVersionUID = -2234768909660948176L;
private byte[] key;
- private String type;
+ private final String type;
/**
* Creates a PBE key from a given PBE key specification.
@@ -94,7 +96,7 @@ public int hashCode() {
for (int i = 1; i < this.key.length; i++) {
retval += this.key[i] * i;
}
- return(retval ^= getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode());
+ return(retval ^ getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode());
}
public boolean equals(Object obj) {
@@ -128,14 +130,32 @@ public void destroy() {
}
/**
- * readObject is called to restore the state of this key from
- * a stream.
+ * Restores the state of this object from the stream.
+ *
+ * @param s the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
*/
private void readObject(java.io.ObjectInputStream s)
- throws java.io.IOException, ClassNotFoundException
+ throws IOException, ClassNotFoundException
{
s.defaultReadObject();
+ if (key == null) {
+ throw new InvalidObjectException(
+ "PBEKey couldn't be deserialized");
+ }
key = key.clone();
+
+ // Accept "\0" to signify "zero-length password with no terminator".
+ if (!(key.length == 1 && key[0] == 0)) {
+ for (int i = 0; i < key.length; i++) {
+ if ((key[i] < '\u0020') || (key[i] > '\u007E')) {
+ throw new InvalidObjectException(
+ "PBEKey had non-ASCII chars");
+ }
+ }
+ }
+
}
diff --git a/jdk/src/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java b/jdk/src/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java
index 506cc731bea..a039c2e77a0 100644
--- a/jdk/src/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java
+++ b/jdk/src/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java
@@ -25,7 +25,7 @@
package com.sun.crypto.provider;
-import java.io.ObjectStreamException;
+import java.io.*;
import java.nio.ByteBuffer;
import java.nio.CharBuffer;
import java.nio.charset.Charset;
@@ -52,14 +52,14 @@
*/
final class PBKDF2KeyImpl implements javax.crypto.interfaces.PBEKey {
- static final long serialVersionUID = -2234868909660948157L;
+ private static final long serialVersionUID = -2234868909660948157L;
private char[] passwd;
- private byte[] salt;
- private int iterCount;
+ private final byte[] salt;
+ private final int iterCount;
private byte[] key;
- private Mac prf;
+ private final Mac prf;
private static byte[] getPasswordBytes(char[] passwd) {
Charset utf8 = Charset.forName("UTF-8");
@@ -131,12 +131,13 @@ private static byte[] deriveKey(final Mac prf, final byte[] password,
int intR = keyLength - (intL - 1)*hlen; // residue
byte[] ui = new byte[hlen];
byte[] ti = new byte[hlen];
+ String algName = prf.getAlgorithm();
// SecretKeySpec cannot be used, since password can be empty here.
SecretKey macKey = new SecretKey() {
private static final long serialVersionUID = 7874493593505141603L;
@Override
public String getAlgorithm() {
- return prf.getAlgorithm();
+ return algName;
}
@Override
public String getFormat() {
@@ -149,18 +150,26 @@ public byte[] getEncoded() {
@Override
public int hashCode() {
return Arrays.hashCode(password) * 41 +
- prf.getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode();
+ algName.toLowerCase(Locale.ENGLISH).hashCode();
}
@Override
public boolean equals(Object obj) {
if (this == obj) return true;
if (this.getClass() != obj.getClass()) return false;
SecretKey sk = (SecretKey)obj;
- return prf.getAlgorithm().equalsIgnoreCase(
+ return algName.equalsIgnoreCase(
sk.getAlgorithm()) &&
MessageDigest.isEqual(password, sk.getEncoded());
}
+ // This derived key can't be deserialized.
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "PBKDF2KeyImpl SecretKeys are not " +
+ "directly deserializable");
+ }
};
+
prf.init(macKey);
byte[] ibytes = new byte[4];
@@ -282,4 +291,19 @@ protected void finalize() throws Throwable {
super.finalize();
}
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this class is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "PBKDF2KeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java b/jdk/src/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java
index 9a6308f3446..ac6cc2ecf88 100644
--- a/jdk/src/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java
+++ b/jdk/src/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.crypto.provider;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.*;
import java.security.spec.AlgorithmParameterSpec;
@@ -59,11 +62,11 @@ protected void engineInit(SecureRandom random) {
protected void engineInit(AlgorithmParameterSpec params,
SecureRandom random) throws InvalidAlgorithmParameterException {
- if (params instanceof TlsMasterSecretParameterSpec == false) {
+ if (!(params instanceof TlsMasterSecretParameterSpec)) {
throw new InvalidAlgorithmParameterException(MSG);
}
this.spec = (TlsMasterSecretParameterSpec)params;
- if ("RAW".equals(spec.getPremasterSecret().getFormat()) == false) {
+ if (!"RAW".equals(spec.getPremasterSecret().getFormat())) {
throw new InvalidAlgorithmParameterException(
"Key format must be RAW");
}
@@ -182,6 +185,21 @@ public byte[] getEncoded() {
return key.clone();
}
- }
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if ((key == null) || (key.length == 0)) {
+ throw new InvalidObjectException("TlsMasterSecretKey is null");
+ }
+ key = key.clone();
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/LdapPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/LdapPrincipal.java
index 6a324eeaccc..7d1380feba9 100644
--- a/jdk/src/share/classes/com/sun/security/auth/LdapPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/LdapPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
@@ -136,4 +139,30 @@ public String toString() {
private LdapName getLdapName(String name) throws InvalidNameException {
return new LdapName(name);
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if ((name == null) || (nameString == null)) {
+ throw new InvalidObjectException(
+ "null name/nameString is illegal");
+ }
+ try {
+ if (!name.equals(getLdapName(nameString))) {
+ throw new InvalidObjectException("Inconsistent names");
+ }
+ } catch (InvalidNameException e) {
+ InvalidObjectException nse = new InvalidObjectException(
+ "Invalid Name");
+ nse.initCause(e);
+ throw nse;
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/NTDomainPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/NTDomainPrincipal.java
index eb7730cd5ad..c1e8361d656 100644
--- a/jdk/src/share/classes/com/sun/security/auth/NTDomainPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/NTDomainPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -131,9 +134,7 @@ public boolean equals(Object o) {
return false;
NTDomainPrincipal that = (NTDomainPrincipal)o;
- if (name.equals(that.getName()))
- return true;
- return false;
+ return name.equals(that.getName());
}
/**
@@ -146,4 +147,24 @@ public boolean equals(Object o) {
public int hashCode() {
return this.getName().hashCode();
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"name"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/NTSid.java b/jdk/src/share/classes/com/sun/security/auth/NTSid.java
index 28b40b9302f..d5e063a7141 100644
--- a/jdk/src/share/classes/com/sun/security/auth/NTSid.java
+++ b/jdk/src/share/classes/com/sun/security/auth/NTSid.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -85,7 +88,7 @@ public NTSid (String stringSid) {
("Invalid.NTSid.value",
"sun.security.util.AuthResources"));
}
- sid = new String(stringSid);
+ sid = stringSid;
}
/**
@@ -140,10 +143,7 @@ public boolean equals(Object o) {
return false;
NTSid that = (NTSid)o;
- if (sid.equals(that.sid)) {
- return true;
- }
- return false;
+ return sid.equals(that.sid);
}
/**
@@ -156,4 +156,30 @@ public boolean equals(Object o) {
public int hashCode() {
return sid.hashCode();
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (sid == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"stringSid"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ if (sid.length() == 0) {
+ throw new InvalidObjectException
+ (sun.security.util.ResourcesMgr.getString
+ ("Invalid.NTSid.value",
+ "sun.security.util.AuthResources"));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/NTUserPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/NTUserPrincipal.java
index 91be069aa10..78015fa8609 100644
--- a/jdk/src/share/classes/com/sun/security/auth/NTUserPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/NTUserPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -125,9 +128,7 @@ public boolean equals(Object o) {
return false;
NTUserPrincipal that = (NTUserPrincipal)o;
- if (name.equals(that.getName()))
- return true;
- return false;
+ return name.equals(that.getName());
}
/**
@@ -140,4 +141,25 @@ public boolean equals(Object o) {
public int hashCode() {
return this.getName().hashCode();
}
+
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"name"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/UnixNumericGroupPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/UnixNumericGroupPrincipal.java
index db5775ab329..046d75f23da 100644
--- a/jdk/src/share/classes/com/sun/security/auth/UnixNumericGroupPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/UnixNumericGroupPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -201,10 +204,8 @@ public boolean equals(Object o) {
return false;
UnixNumericGroupPrincipal that = (UnixNumericGroupPrincipal)o;
- if (this.getName().equals(that.getName()) &&
- this.isPrimaryGroup() == that.isPrimaryGroup())
- return true;
- return false;
+ return this.getName().equals(that.getName()) &&
+ this.isPrimaryGroup() == that.isPrimaryGroup();
}
/**
@@ -217,4 +218,24 @@ public boolean equals(Object o) {
public int hashCode() {
return toString().hashCode();
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"name"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/UnixNumericUserPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/UnixNumericUserPrincipal.java
index c6dfd7eaf1b..b8a8633d3cc 100644
--- a/jdk/src/share/classes/com/sun/security/auth/UnixNumericUserPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/UnixNumericUserPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -161,9 +164,7 @@ public boolean equals(Object o) {
return false;
UnixNumericUserPrincipal that = (UnixNumericUserPrincipal)o;
- if (this.getName().equals(that.getName()))
- return true;
- return false;
+ return this.getName().equals(that.getName());
}
/**
@@ -176,4 +177,24 @@ public boolean equals(Object o) {
public int hashCode() {
return name.hashCode();
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"name"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/UnixPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/UnixPrincipal.java
index 4aefaf9b7f2..de7af16db05 100644
--- a/jdk/src/share/classes/com/sun/security/auth/UnixPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/UnixPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -126,9 +129,7 @@ public boolean equals(Object o) {
return false;
UnixPrincipal that = (UnixPrincipal)o;
- if (this.getName().equals(that.getName()))
- return true;
- return false;
+ return this.getName().equals(that.getName());
}
/**
@@ -141,4 +142,24 @@ public boolean equals(Object o) {
public int hashCode() {
return name.hashCode();
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ java.text.MessageFormat form = new java.text.MessageFormat
+ (sun.security.util.ResourcesMgr.getString
+ ("invalid.null.input.value",
+ "sun.security.util.AuthResources"));
+ Object[] source = {"name"};
+ throw new InvalidObjectException(form.format(source));
+ }
+ }
}
diff --git a/jdk/src/share/classes/com/sun/security/auth/UserPrincipal.java b/jdk/src/share/classes/com/sun/security/auth/UserPrincipal.java
index f4e7555ab1a..2d39ca5621f 100644
--- a/jdk/src/share/classes/com/sun/security/auth/UserPrincipal.java
+++ b/jdk/src/share/classes/com/sun/security/auth/UserPrincipal.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package com.sun.security.auth;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.Principal;
/**
@@ -110,4 +113,19 @@ public String getName() {
public String toString() {
return name;
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (name == null) {
+ throw new InvalidObjectException("null name is illegal");
+ }
+ }
}
diff --git a/jdk/src/share/classes/java/security/CodeSigner.java b/jdk/src/share/classes/java/security/CodeSigner.java
index 37c12b153b3..67240408757 100644
--- a/jdk/src/share/classes/java/security/CodeSigner.java
+++ b/jdk/src/share/classes/java/security/CodeSigner.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -156,9 +156,9 @@ public boolean equals(Object obj) {
public String toString() {
StringBuffer sb = new StringBuffer();
sb.append("(");
- sb.append("Signer: " + signerCertPath.getCertificates().get(0));
+ sb.append("Signer: ").append(signerCertPath.getCertificates().get(0));
if (timestamp != null) {
- sb.append("timestamp: " + timestamp);
+ sb.append("timestamp: ").append(timestamp);
}
sb.append(")");
return sb.toString();
@@ -166,8 +166,11 @@ public String toString() {
// Explicitly reset hash code value to -1
private void readObject(ObjectInputStream ois)
- throws IOException, ClassNotFoundException {
- ois.defaultReadObject();
- myhash = -1;
+ throws IOException, ClassNotFoundException {
+ ois.defaultReadObject();
+ if (signerCertPath == null) {
+ throw new InvalidObjectException("signerCertPath is null");
+ }
+ myhash = -1;
}
}
diff --git a/jdk/src/share/classes/java/security/cert/CertPathHelperImpl.java b/jdk/src/share/classes/java/security/cert/CertPathHelperImpl.java
index c56a5f1458d..54cc8af3acf 100644
--- a/jdk/src/share/classes/java/security/cert/CertPathHelperImpl.java
+++ b/jdk/src/share/classes/java/security/cert/CertPathHelperImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,12 +25,10 @@
package java.security.cert;
-import java.util.*;
+import java.util.Date;
import sun.security.provider.certpath.CertPathHelper;
-import sun.security.x509.GeneralNameInterface;
-
/**
* Helper class that allows the Sun CertPath provider to access
* implementation dependent APIs in CertPath framework.
@@ -55,11 +53,6 @@ synchronized static void initialize() {
}
}
- protected void implSetPathToNames(X509CertSelector sel,
- Set Underlying security services instantiate and pass a
* {@code ChoiceCallback} to the {@code handle}
@@ -103,15 +107,15 @@ public ChoiceCallback(String prompt, String[] choices,
defaultChoice < 0 || defaultChoice >= choices.length)
throw new IllegalArgumentException();
+ this.prompt = prompt;
+ this.defaultChoice = defaultChoice;
+ this.multipleSelectionsAllowed = multipleSelectionsAllowed;
+
+ this.choices = choices.clone();
for (int i = 0; i < choices.length; i++) {
if (choices[i] == null || choices[i].length() == 0)
throw new IllegalArgumentException();
}
-
- this.prompt = prompt;
- this.choices = choices.clone();
- this.defaultChoice = defaultChoice;
- this.multipleSelectionsAllowed = multipleSelectionsAllowed;
}
/**
@@ -206,6 +210,6 @@ public void setSelectedIndexes(int[] selections) {
* @see #setSelectedIndexes
*/
public int[] getSelectedIndexes() {
- return selections == null ? null : selections.clone();
+ return selections;
}
}
diff --git a/jdk/src/share/classes/javax/security/auth/callback/ConfirmationCallback.java b/jdk/src/share/classes/javax/security/auth/callback/ConfirmationCallback.java
index 005ff6333fe..55121596ace 100644
--- a/jdk/src/share/classes/javax/security/auth/callback/ConfirmationCallback.java
+++ b/jdk/src/share/classes/javax/security/auth/callback/ConfirmationCallback.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
package javax.security.auth.callback;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+
/**
* Underlying security services instantiate and pass a
* {@code ConfirmationCallback} to the {@code handle}
@@ -253,16 +256,16 @@ public ConfirmationCallback(int messageType,
defaultOption < 0 || defaultOption >= options.length)
throw new IllegalArgumentException();
- for (int i = 0; i < options.length; i++) {
- if (options[i] == null || options[i].length() == 0)
- throw new IllegalArgumentException();
- }
-
this.prompt = null;
this.messageType = messageType;
this.optionType = UNSPECIFIED_OPTION;
- this.options = options.clone();
this.defaultOption = defaultOption;
+
+ this.options = options.clone();
+ for (int i = 0; i < options.length; i++) {
+ if (options[i] == null || options[i].length() == 0)
+ throw new IllegalArgumentException();
+ }
}
/**
@@ -376,16 +379,16 @@ public ConfirmationCallback(String prompt, int messageType,
defaultOption < 0 || defaultOption >= options.length)
throw new IllegalArgumentException();
- for (int i = 0; i < options.length; i++) {
- if (options[i] == null || options[i].length() == 0)
- throw new IllegalArgumentException();
- }
-
this.prompt = prompt;
this.messageType = messageType;
this.optionType = UNSPECIFIED_OPTION;
- this.options = options.clone();
this.defaultOption = defaultOption;
+
+ this.options = options.clone();
+ for (int i = 0; i < options.length; i++) {
+ if (options[i] == null || options[i].length() == 0)
+ throw new IllegalArgumentException();
+ }
}
/**
@@ -505,4 +508,19 @@ public void setSelectedIndex(int selection) {
public int getSelectedIndex() {
return selection;
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (options != null) {
+ options = options.clone();
+ }
+ }
}
diff --git a/jdk/src/share/classes/javax/security/auth/callback/PasswordCallback.java b/jdk/src/share/classes/javax/security/auth/callback/PasswordCallback.java
index 0e8fb7bd794..6333804d862 100644
--- a/jdk/src/share/classes/javax/security/auth/callback/PasswordCallback.java
+++ b/jdk/src/share/classes/javax/security/auth/callback/PasswordCallback.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,12 @@
package javax.security.auth.callback;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
+import java.util.Arrays;
+import sun.misc.Cleaner;
+
/**
* Underlying security services instantiate and pass a
* {@code PasswordCallback} to the {@code handle}
@@ -40,18 +46,22 @@ public class PasswordCallback implements Callback, java.io.Serializable {
* @serial
* @since 1.4
*/
- private String prompt;
+ private final String prompt;
+
/**
* @serial
* @since 1.4
*/
- private boolean echoOn;
+ private final boolean echoOn;
+
/**
* @serial
* @since 1.4
*/
private char[] inputPassword;
+ private transient Cleaner cleaner;
+
/**
* Construct a {@code PasswordCallback} with a prompt
* and a boolean specifying whether the password should be displayed
@@ -112,7 +122,18 @@ public boolean isEchoOn() {
* @see #getPassword
*/
public void setPassword(char[] password) {
+ // Cleanup the last buffered password copy.
+ if (cleaner != null) {
+ cleaner.clean();
+ cleaner = null;
+ }
+
+ // Set the retrieved password.
this.inputPassword = (password == null ? null : password.clone());
+
+ if (this.inputPassword != null) {
+ cleaner = Cleaner.create(this, cleanerFor(inputPassword));
+ }
}
/**
@@ -134,9 +155,38 @@ public char[] getPassword() {
* Clear the retrieved password.
*/
public void clearPassword() {
+ // Cleanup the last retrieved password copy.
+ if (cleaner != null) {
+ cleaner.clean();
+ cleaner = null;
+ }
+ }
+
+ private static Runnable cleanerFor(char[] password) {
+ return () -> {
+ Arrays.fill(password, ' ');
+ };
+ }
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+
+ if (prompt == null || prompt.isEmpty()) {
+ throw new InvalidObjectException("Missing prompt");
+ }
+
if (inputPassword != null) {
- for (int i = 0; i < inputPassword.length; i++)
- inputPassword[i] = ' ';
+ inputPassword = inputPassword.clone();
+ cleaner = Cleaner.create(this, cleanerFor(inputPassword));
}
}
+
}
diff --git a/jdk/src/share/classes/sun/security/ec/ECPrivateKeyImpl.java b/jdk/src/share/classes/sun/security/ec/ECPrivateKeyImpl.java
index e423850cc38..3f5bda39b8c 100644
--- a/jdk/src/share/classes/sun/security/ec/ECPrivateKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/ec/ECPrivateKeyImpl.java
@@ -26,6 +26,8 @@
package sun.security.ec;
import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.math.BigInteger;
import java.security.*;
@@ -43,7 +45,7 @@
/**
* Key implementation for EC private keys.
- *
+ *
* ASN.1 syntax for EC private keys from SEC 1 v1.5 (draft):
*
*
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "ECPrivateKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/ec/ECPublicKeyImpl.java b/jdk/src/share/classes/sun/security/ec/ECPublicKeyImpl.java
index f17d52c46b7..6da122fe620 100644
--- a/jdk/src/share/classes/sun/security/ec/ECPublicKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/ec/ECPublicKeyImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -27,6 +27,8 @@
import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.security.*;
import java.security.interfaces.*;
import java.security.spec.*;
@@ -122,10 +124,25 @@ public String toString() {
+ "\n parameters: " + params;
}
- protected Object writeReplace() throws java.io.ObjectStreamException {
+ private Object writeReplace() throws java.io.ObjectStreamException {
return new KeyRep(KeyRep.Type.PUBLIC,
getAlgorithm(),
getFormat(),
getEncoded());
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "ECPublicKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/pkcs11/Token.java b/jdk/src/share/classes/sun/security/pkcs11/Token.java
index 39d301ae7b8..f9db262b0a1 100644
--- a/jdk/src/share/classes/sun/security/pkcs11/Token.java
+++ b/jdk/src/share/classes/sun/security/pkcs11/Token.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -416,11 +416,26 @@ private synchronized byte[] getTokenId() {
private Object writeReplace() throws ObjectStreamException {
if (isValid() == false) {
- throw new NotSerializableException("Token has been removed");
+ throw new InvalidObjectException("Token has been removed");
}
return new TokenRep(this);
}
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "Tokens are not directly deserializable");
+ }
+
// serialized representation of a token
// tokens can only be de-serialized within the same VM invocation
// and if the token has not been removed in the meantime
@@ -443,7 +458,7 @@ private Object readResolve() throws ObjectStreamException {
}
}
}
- throw new NotSerializableException("Could not find token");
+ throw new InvalidObjectException("Could not find token");
}
}
diff --git a/jdk/src/share/classes/sun/security/provider/DSAPublicKeyImpl.java b/jdk/src/share/classes/sun/security/provider/DSAPublicKeyImpl.java
index 7ccc1c0239f..a97a901f87f 100644
--- a/jdk/src/share/classes/sun/security/provider/DSAPublicKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/provider/DSAPublicKeyImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,17 +25,20 @@
package sun.security.provider;
+import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.math.BigInteger;
import java.security.KeyRep;
import java.security.InvalidKeyException;
/**
* An X.509 public key for the Digital Signature Algorithm.
- *
+ *
* The difference between DSAPublicKeyImpl and DSAPublicKey is that
* DSAPublicKeyImpl calls writeReplace with KeyRep, and DSAPublicKey
* calls writeObject.
- *
+ *
* See the comments in DSAKeyFactory, 4532506, and 6232513.
*
*/
@@ -70,10 +73,25 @@ public DSAPublicKeyImpl(byte[] encoded) throws InvalidKeyException {
super(encoded);
}
- protected Object writeReplace() throws java.io.ObjectStreamException {
+ private Object writeReplace() throws java.io.ObjectStreamException {
return new KeyRep(KeyRep.Type.PUBLIC,
getAlgorithm(),
getFormat(),
getEncoded());
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "DSAPublicKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/provider/PolicyFile.java b/jdk/src/share/classes/sun/security/provider/PolicyFile.java
index 097451da742..a980277883a 100644
--- a/jdk/src/share/classes/sun/security/provider/PolicyFile.java
+++ b/jdk/src/share/classes/sun/security/provider/PolicyFile.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -2214,8 +2214,17 @@ public SelfPermission(String type, String name, String actions,
this.actions.equals(that.actions)))
return false;
- if (this.certs.length != that.certs.length)
+ if ((this.certs == null) && (that.certs == null)) {
+ return true;
+ }
+
+ if ((this.certs == null) || (that.certs == null)) {
+ return false;
+ }
+
+ if (this.certs.length != that.certs.length) {
return false;
+ }
int i,j;
boolean match;
@@ -2285,7 +2294,7 @@ public String getSelfActions() {
}
public Certificate[] getCerts() {
- return certs;
+ return (certs == null ? null : certs.clone());
}
/**
@@ -2298,6 +2307,21 @@ public Certificate[] getCerts() {
@Override public String toString() {
return "(SelfPermission " + type + " " + name + " " + actions + ")";
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ stream.defaultReadObject();
+ if (certs != null) {
+ this.certs = certs.clone();
+ }
+ }
}
/**
diff --git a/jdk/src/share/classes/sun/security/provider/SecureRandom.java b/jdk/src/share/classes/sun/security/provider/SecureRandom.java
index 4f7d7c3aad6..5ffc81b16ff 100644
--- a/jdk/src/share/classes/sun/security/provider/SecureRandom.java
+++ b/jdk/src/share/classes/sun/security/provider/SecureRandom.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1998, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
package sun.security.provider;
import java.io.IOException;
+import java.io.InvalidObjectException;
import java.security.MessageDigest;
import java.security.SecureRandomSpi;
import java.security.NoSuchAlgorithmException;
@@ -186,7 +187,7 @@ private static void updateState(byte[] state, byte[] output) {
/**
* This static object will be seeded by SeedGenerator, and used
* to seed future instances of SHA1PRNG SecureRandoms.
- *
+ *
* Bloch, Effective Java Second Edition: Item 71
*/
private static class SeederHolder {
@@ -261,17 +262,23 @@ public synchronized void engineNextBytes(byte[] result) {
}
/*
- * readObject is called to restore the state of the random object from
- * a stream. We have to create a new instance of MessageDigest, because
+ * This method is called to restore the state of the random object from
+ * a stream.
+ *
+ * We have to create a new instance of {@code MessageDigest}, because
* it is not included in the stream (it is marked "transient").
- *
- * Note that the engineNextBytes() method invoked on the restored random
- * object will yield the exact same (random) bytes as the original.
+ *
+ * Note that the {@code engineNextBytes()} method invoked on the restored
+ * random object will yield the exact same (random) bytes as the original.
* If you do not want this behaviour, you should re-seed the restored
- * random object, using engineSetSeed().
+ * random object, using {@code engineSetSeed()}.
+ *
+ * @param s the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
*/
private void readObject(java.io.ObjectInputStream s)
- throws IOException, ClassNotFoundException {
+ throws IOException, ClassNotFoundException {
s.defaultReadObject ();
@@ -290,5 +297,34 @@ private void readObject(java.io.ObjectInputStream s)
"internal error: SHA-1 not available.", exc);
}
}
+
+ // Various consistency checks
+ if ((remainder == null) && (remCount > 0)) {
+ throw new InvalidObjectException(
+ "Remainder indicated, but no data available");
+ }
+
+ // Not yet allocated state
+ if (state == null) {
+ if (remainder == null) {
+ return;
+ } else {
+ throw new InvalidObjectException(
+ "Inconsistent buffer allocations");
+ }
+ }
+
+ // Sanity check on sizes/pointer
+ if ((state.length != DIGEST_SIZE) ||
+ ((remainder != null) && (remainder.length != DIGEST_SIZE)) ||
+ (remCount < 0 ) || (remCount >= DIGEST_SIZE)) {
+ throw new InvalidObjectException(
+ "Inconsistent buffer sizes/state");
+ }
+
+ state = state.clone();
+ if (remainder != null) {
+ remainder = remainder.clone();
+ }
}
}
diff --git a/jdk/src/share/classes/sun/security/provider/certpath/CertPathHelper.java b/jdk/src/share/classes/sun/security/provider/certpath/CertPathHelper.java
index 7c02007422d..ebc2200f0e6 100644
--- a/jdk/src/share/classes/sun/security/provider/certpath/CertPathHelper.java
+++ b/jdk/src/share/classes/sun/security/provider/certpath/CertPathHelper.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,14 +26,10 @@
package sun.security.provider.certpath;
import java.util.Date;
-import java.util.Set;
import java.security.cert.TrustAnchor;
-import java.security.cert.X509CertSelector;
import java.security.cert.X509CRLSelector;
-import sun.security.x509.GeneralNameInterface;
-
/**
* Helper class that allows access to JDK specific known-public methods in the
* java.security.cert package. It relies on a subclass in the
@@ -55,18 +51,10 @@ protected CertPathHelper() {
// empty
}
- protected abstract void implSetPathToNames(X509CertSelector sel,
- Set
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "X509CertPaths are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
index b3c1fae9672..4cb407e2508 100644
--- a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,8 @@
package sun.security.rsa;
import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.math.BigInteger;
import java.security.*;
@@ -43,7 +45,7 @@
* RSA private key implementation for "RSA", "RSASSA-PSS" algorithms in CRT form.
* For non-CRT private keys, see RSAPrivateKeyImpl. We need separate classes
* to ensure correct behavior in instanceof checks, etc.
- *
+ *
* Note: RSA keys must be at least 512 bits long
*
* @see RSAPrivateKeyImpl
@@ -291,4 +293,19 @@ protected void parseKeyBits() throws InvalidKeyException {
throw new InvalidKeyException("Invalid RSA private key", e);
}
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "RSAPrivateCrtKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java b/jdk/src/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java
index df5abc1bfd0..b443caf91fd 100644
--- a/jdk/src/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,8 @@
package sun.security.rsa;
import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.math.BigInteger;
import java.security.*;
@@ -38,10 +40,11 @@
/**
* RSA private key implementation for "RSA", "RSASSA-PSS" algorithms in non-CRT
- * form (modulus, private exponent only). For CRT private keys, see
- * RSAPrivateCrtKeyImpl. We need separate classes to ensure correct behavior
- * in instanceof checks, etc.
- *
+ * form (modulus, private exponent only).
+ *
+ * For CRT private keys, see RSAPrivateCrtKeyImpl. We need separate classes
+ * to ensure correct behavior in instanceof checks, etc.
+ *
* Note: RSA keys must be at least 512 bits long
*
* @see RSAPrivateCrtKeyImpl
@@ -127,4 +130,19 @@ public String toString() {
+ " bits" + "\n params: " + keyParams + "\n modulus: " + n
+ "\n private exponent: " + d;
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "RSAPrivateKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPublicKeyImpl.java b/jdk/src/share/classes/sun/security/rsa/RSAPublicKeyImpl.java
index ebd035e06a8..279fc19edec 100644
--- a/jdk/src/share/classes/sun/security/rsa/RSAPublicKeyImpl.java
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPublicKeyImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,8 @@
package sun.security.rsa;
import java.io.IOException;
+import java.io.InvalidObjectException;
+import java.io.ObjectInputStream;
import java.math.BigInteger;
import java.security.*;
@@ -40,7 +42,7 @@
/**
* RSA public key implementation for "RSA", "RSASSA-PSS" algorithms.
- *
+ *
* Note: RSA keys must be at least 512 bits long
*
* @see RSAPrivateCrtKeyImpl
@@ -198,10 +200,25 @@ public String toString() {
+ "\n public exponent: " + e;
}
- protected Object writeReplace() throws java.io.ObjectStreamException {
+ private Object writeReplace() throws java.io.ObjectStreamException {
return new KeyRep(KeyRep.Type.PUBLIC,
getAlgorithm(),
getFormat(),
getEncoded());
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *
+ * Deserialization of this object is not supported.
+ *
+ * @param stream the {@code ObjectInputStream} from which data is read
+ * @throws IOException if an I/O error occurs
+ * @throws ClassNotFoundException if a serialized class cannot be loaded
+ */
+ private void readObject(ObjectInputStream stream)
+ throws IOException, ClassNotFoundException {
+ throw new InvalidObjectException(
+ "RSAPublicKeyImpl keys are not directly deserializable");
+ }
}
diff --git a/jdk/src/share/classes/sun/security/x509/X509CertImpl.java b/jdk/src/share/classes/sun/security/x509/X509CertImpl.java
index 012bb8cf823..818ae1e2619 100644
--- a/jdk/src/share/classes/sun/security/x509/X509CertImpl.java
+++ b/jdk/src/share/classes/sun/security/x509/X509CertImpl.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,13 +25,7 @@
package sun.security.x509;
-import java.io.BufferedReader;
-import java.io.BufferedInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
+import java.io.*;
import java.math.BigInteger;
import java.security.*;
import java.security.spec.AlgorithmParameterSpec;
@@ -679,7 +673,7 @@ public void checkValidity(Date date)
/**
* Return the requested attribute from the certificate.
- *
+ *
* Note that the X509CertInfo is not cloned for performance reasons.
* Callers must ensure that they do not modify it. All other
* attributes are cloned.
@@ -1597,7 +1591,7 @@ private static Collection
@@ -213,4 +215,19 @@ protected void parseKeyBits() throws InvalidKeyException {
throw new InvalidKeyException("Invalid EC private key", e);
}
}
+
+ /**
+ * Restores the state of this object from the stream.
+ *