RFR: 8365288: PEMDecoder should throw ClassCastException [v3]
Anthony Scarpino
ascarpino at openjdk.org
Thu Aug 28 16:20:01 UTC 2025
On Mon, 25 Aug 2025 19:44:25 GMT, Anthony Scarpino <ascarpino at openjdk.org> wrote:
>> src/java.base/share/classes/java/security/PEMDecoder.java line 440:
>>
>>> 438: .getKeySpec(key, X509EncodedKeySpec.class);
>>> 439: } else {
>>> 440: throw new IllegalArgumentException("Invalid KeySpec.");
>>
>> Should this also be CCE?
>
> I would say no. This checks that `tClass` is a valid class to cast to. That should be an IAE because it's a input value. The CCE happens when the KeyFactory rejected a valid class argument.
Turns out all the other incorrect classes return CCE, so switching this one is consistent.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/26734#discussion_r2307911777
More information about the security-dev
mailing list