adoptium / adoptium/adoptium-support
SSLConfiguration.setSSLParameters removes applicationProtocols from existing SSLParameters
- Dominant language
- No language data
- Stars
- 59
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
jdk-11.0.11+9 Windows 64
## Summary
The default constructor of SSLParams creates an empty list for applicationProtocols
The SSLparameter merger checks for null rather than empty list.
Therefore the application protocols are always updated rather than retained
## Steps to reproduce
The following unit test fails because an empty list is returned rather than the expected sigle "foo"
@Test
public void testParamsBad() throws Exception
{
final SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);
final SSLParameters par = sslContext.getSupportedSSLParameters();
final SSLSocketFactory socketFactory = sslContext.getSocketFactory();
final SSLSocket sock = (SSLSocket) socketFactory.createSocket();
final String[] protocols = new String[] { "foo" };
par.setApplicationProtocols(protocols);
sock.setSSLParameters(par);
final SSLParameters par2 = new SSLParameters();
sock.setSSLParameters(par2);
assertArrayEquals(protocols, sock.getSSLParameters().getApplicationProtocols());
}
## Expected results
String[]{"foo"}
## Actual results
String[]
## Triaging info
Java version:
openjdk version "11.0.11" 2021-04-20
OpenJDK Runtime Environment AdoptOpenJDK-11.0.11+9 (build 11.0.11+9)
OpenJDK 64-Bit Server VM AdoptOpenJDK-11.0.11+9 (build 11.0.11+9, mixed mode)
## Suggested fix:
package sun.security.ssl;
final class SSLConfiguration implements Cloneable {
void setSSLParameters(SSLParameters params) {
sa = params.getApplicationProtocols();
//
if (sa != null) {
this.applicationProtocols = sa;
} // otherwise, use the default values
sa = params.getApplicationProtocols();
//
**if (sa != null && sa.length!=0) {**
this.applicationProtocols = sa;
} // otherwise, use the default values
Contributor guide
Research direction
Start with the reproduction test included in the issue and inspect sun.security.ssl.SSLConfiguration.setSSLParameters, where applicationProtocols are merged. The work is done when an empty application-protocol array does not replace existing values and the test retains "foo".
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100