adoptium / adoptium/adoptium-support

SSLConfiguration.setSSLParameters removes applicationProtocols from existing SSLParameters

Open
#310 0 comments 0 reactions 0 assignees View on GitHub
bug jbs:needs-report
Dominant language
No language data
Stars
59
Forks
13
PR merge metrics
No merged PRs in 30d

Description

jdk-11.0.11+9 Windows 64
## Summary
The default constructor of SSLParams creates an empty list for applicationProtocols
The SSLparameter merger checks for null rather than empty list.
Therefore the application protocols are always updated rather than retained

## Steps to reproduce

The following unit test fails because an empty list is returned rather than the expected sigle "foo"
@Test
public void testParamsBad() throws Exception
{
final SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);
final SSLParameters par = sslContext.getSupportedSSLParameters();
final SSLSocketFactory socketFactory = sslContext.getSocketFactory();

final SSLSocket sock = (SSLSocket) socketFactory.createSocket();
final String[] protocols = new String[] { "foo" };
par.setApplicationProtocols(protocols);
sock.setSSLParameters(par);
final SSLParameters par2 = new SSLParameters();
sock.setSSLParameters(par2);
assertArrayEquals(protocols, sock.getSSLParameters().getApplicationProtocols());
}

## Expected results

String[]{"foo"}

## Actual results

String[]

## Triaging info

Java version:

openjdk version "11.0.11" 2021-04-20
OpenJDK Runtime Environment AdoptOpenJDK-11.0.11+9 (build 11.0.11+9)
OpenJDK 64-Bit Server VM AdoptOpenJDK-11.0.11+9 (build 11.0.11+9, mixed mode)

## Suggested fix:
package sun.security.ssl;
final class SSLConfiguration implements Cloneable {
void setSSLParameters(SSLParameters params) {
sa = params.getApplicationProtocols();
//
if (sa != null) {
this.applicationProtocols = sa;
} // otherwise, use the default values

sa = params.getApplicationProtocols();
//
**if (sa != null && sa.length!=0) {**
this.applicationProtocols = sa;
} // otherwise, use the default values

Contributor guide

Open the contributing guide

Research direction

Start with the reproduction test included in the issue and inspect sun.security.ssl.SSLConfiguration.setSSLParameters, where applicationProtocols are merged. The work is done when an empty application-protocol array does not replace existing values and the test retains "foo".

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.