Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Date: Fri, 4 Jul 2014 08:33:34 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: derby-dev@db.apache.org
Message-ID: <JIRA.12722486.1403181152241.3730.1404462814390@arcas>
In-Reply-To: <JIRA.12722486.1403181152241@arcas>
References: <JIRA.12722486.1403181152241@arcas>
Subject: [jira] [Commented] (DERBY-6626) Check type of user-supplied modules
 before creating instances
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/DERBY-6626?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14052257#comment-14052257 ] 

ASF subversion and git services commented on DERBY-6626:
--------------------------------------------------------

Commit 1607795 from [~knutanders] in branch 'code/trunk'
[ https://svn.apache.org/r1607795 ]

DERBY-6626: Check type of user-supplied modules before creating instances

Make SequenceUpdater verify that the class specified by the
derby.language.sequence.preallocator property is a
SequencePreallocator before attempting to create an instance of it.

Make dblook and ij verify that user-specified JDBC driver class names
and DataSource class names implement the correct interfaces before
attempting to create and use them.

> Check type of user-supplied modules before creating instances
> -------------------------------------------------------------
>
>                 Key: DERBY-6626
>                 URL: https://issues.apache.org/jira/browse/DERBY-6626
>             Project: Derby
>          Issue Type: Improvement
>          Components: Miscellaneous
>    Affects Versions: 10.11.0.0
>            Reporter: Knut Anders Hatlen
>         Attachments: d6626-1a-encryptionProvider.diff, d6626-2a.diff
>
>
> Derby allows users to specify names of classes to use for various pluggable modules.
> In some cases, it verifies that the class implements the expected interface before it creates an instance of the class. For example in SpecificAuthenticactionServiceImpl:
> {code}
> 			Class sasClass = Class.forName(specificAuthenticationScheme);
> 			if (!UserAuthenticator.class.isAssignableFrom(sasClass)) {
> 				throw StandardException.newException(SQLState.AUTHENTICATION_NOT_IMPLEMENTED,
> 					specificAuthenticationScheme, "org.apache.derby.authentication.UserAuthenticator");
> 			}
> 			UserAuthenticator aScheme = (UserAuthenticator) sasClass.newInstance();
> {code}
> In other cases, it creates an instance without checking, and instead fails with a ClassCastException or some other exception when trying to use the instance of the incorrect type. Examples: Java5SystemProcedures SYSCS_REGISTER_TOOL(), JCECipherFactory, SequenceUpdater.makePreallocator().
> I think it would be good to have similar checks in these other cases too. That'll give clearer error messages which explain what the problem is, and it will be safer because it limits which constructors the users can force the Derby engine to invoke.


--
This message was sent by Atlassian JIRA
(v6.2#6252)