jakartaee / jakartaee/security

LinkageError in IdentityStore.validate()

Open
#116 3 comments 0 reactions 1 assignee Claimed by @arjantijms View on GitHub
bug
Dominant language
Java
Stars
66
Forks
43
PR merge metrics
No merged PRs in 30d

Description

The use of `MethodHandles` in `IdentityStore.validate()` may lead to linkage errors.

This issue may occur in

```java
MethodHandles.lookup()
.bind(this, "validate", methodType(CredentialValidationResult.class, credential.getClass()))
```

when redeploying a web application.

In this case, `methodType()` may return a stale reference caused by the internal use of weak references which may still hang around if the classloader of the original deployment has not yet been garbage collected.

I ran into this problem when executing an Arquillian test suite on a remote server, where every test class gives rise to a new deployment. Observed on Java 8 as well as Java 11.

See https://github.com/hwellmann/method-type-leak for a self-contained test case.

Possible workaround:

Override `IdentityStore.validate(Credential)` in your custom class and downcast the `Credential`argument to the concrete type.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.