Integrated: 8329213: Better validation for com.sun.security.ocsp.useget option

Aleksey Shipilev shade at openjdk.org
Mon Apr 1 17:29:38 UTC 2024


On Wed, 27 Mar 2024 19:31:35 GMT, Aleksey Shipilev <shade at openjdk.org> wrote:

> [JDK-8328638](https://bugs.openjdk.org/browse/JDK-8328638) introduced a new boolean option, `com.sun.security.ocsp.useget`. We use the usual `Boolean.parseBoolean` to convert it from String to boolean value, which works correctly for `false` and `true` as boolean values. However, any string that is not `true` would be treated as `false`. Which means that if users mistype the value, they would get a `false`, which is a non-default value, which is against the spirit of the JDK-8328638.
> 
> It would be preferable to validate the option range a bit better, and default to the correct value on any error.
> 
> Additional testing:
>   - [x] Eyeballing `GetAndPostTests` debugging, checking that GET/POST are properly enabled/disabled for `false`, `true`, `foobar` passed as option values
>   - [x] `jdk_security`, out of the box
>   - [x] `jdk_security` with `-Dcom.sun.security.ocsp.useget=false` passes
>   - [x] `jdk_security` with `-Dcom.sun.security.ocsp.useget=foobar` passes

This pull request has now been integrated.

Changeset: 4a14cba2
Author:    Aleksey Shipilev <shade at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/4a14cba2f1632c5cb91e37a07638ea6d8ad4ec00
Stats:     48 lines in 4 files changed: 43 ins; 0 del; 5 mod

8329213: Better validation for com.sun.security.ocsp.useget option

Reviewed-by: mullan

-------------

PR: https://git.openjdk.org/jdk/pull/18525



More information about the security-dev mailing list