box / box/box-java-sdk

Make IPrivateKeyDecryptor Instantiation Configurable in JWTEncryptionPreferences to avoid compilation-time errors

Ouverte
#1,310 1 commentaire 0 réactions 5 personnes assignées Réclamée par @mwwoda Voir sur GitHub
enhancement
Langage dominant
Java
Étoiles
170
Forks
189
Merge moyen
20 h 26 min
PR mergées (30 j)
22

Description

### Is your feature request related to a problem? Please describe.
The class `JWTEncryptionPreferences` has a private `IPrivateKeyDecryptor` field (`privateKeyDecryptor`) that is instantiated immediately with `BCPrivateKeyDecryptor()`. Although it is possible to override the `IPrivateKeyDecryptor` later via a call to `boxConfig.setPrivateKeyDecryptor`, by the time this becomes possible, `BCPrivateKeyDecryptor()` has already been instantiated. `BCPrivateKeyDecryptor` imports `BouncyCastleProvider`, which we exclude from dependencies to ensure that only FIPS-compliant BouncyCastle libraries are present, resulting in a failure.

### Describe the solution you'd like
It would be helpful if the instantiation of `JWTEncryptionPreferences` became more configurable. For example, moving this instantiation to a default constructor while allowing an alternative constructor, or utilizing interfaces to make it easier to override the functionality altogether.

### Describe alternatives you've considered
1. Allowing `BouncyCastleProvider` in just for the sake of not receiving compilation-time errors.
2. Implementing a fake `BouncyCastleProvider` to "trick" the compiler.
3. Using reflection.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.