jakartaee / jakartaee/security
LinkageError in IdentityStore.validate()
- Dominant language
- Java
- Stars
- 66
- Forks
- 43
- PR merge metrics
- No merged PRs in 30d
Description
The use of `MethodHandles` in `IdentityStore.validate()` may lead to linkage errors.
This issue may occur in
```java
MethodHandles.lookup()
.bind(this, "validate", methodType(CredentialValidationResult.class, credential.getClass()))
```
when redeploying a web application.
In this case, `methodType()` may return a stale reference caused by the internal use of weak references which may still hang around if the classloader of the original deployment has not yet been garbage collected.
I ran into this problem when executing an Arquillian test suite on a remote server, where every test class gives rise to a new deployment. Observed on Java 8 as well as Java 11.
See https://github.com/hwellmann/method-type-leak for a self-contained test case.
Possible workaround:
Override `IdentityStore.validate(Credential)` in your custom class and downcast the `Credential`argument to the concrete type.
Contributor guide
Assessment
This issue has not been assessed yet.