RFR[9] 8062731: Cipher object can be created without calling Cipher.getInstance
Valerie Peng
valerie.peng at oracle.com
Mon Jan 23 20:28:49 UTC 2017
Hi Brad,
Would you have time to review this? I changed the code to base the trust
decision on the immediate caller of Cipher(CipherSpi, Provider, String).
In addition, the specified Provider object is only taken into account
when it shares the same origin (codebase or module) with the caller.
Webrev: http://cr.openjdk.java.net/~valeriep/8062731/webrev.00/
Thanks,
Valerie
More information about the security-dev
mailing list