[java-opensaml2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/saml2/metadata/provider/...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Sep 28 19:32:34 2012
New Revision: 1592

URL: http://svn.shibboleth.net/view/java-opensaml2?rev=1592&view=rev
Log:
JOST-192: org.opensaml.saml2.metadata.provider.SignatureValidationFilter => java.lang.UnsupportedOperationException

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/SignatureValidationFilter.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=1592&r1=1591&r2=1592&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Fri Sep 28 19:32:34 2012
@@ -6,6 +6,7 @@
 [JOST-188] - DefaultBootstrap is unnecessarily calling Velocity singleton initialization
 [JOST-190] - Backport some bugfixes from OpenSAML3
 [JOST-191] - Further Bugfixes to XACML\policy
+[JOST-192] - org.opensaml.saml2.metadata.provider.SignatureValidationFilter => java.lang.UnsupportedOperationException
 [JOST-193] - Make the implementation of custom bootstrap code easier, without relying on private data from DefaultBootstrap
 [JOST-194] - org.opensaml.ESAPISecurityConfig should use singleton pattern like the default ESAPI reference class
 [JOST-195] - Use system property-based override for our custom ESAPI config rather than ESAPI locator class call 

Modified: branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/SignatureValidationFilter.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/SignatureValidationFilter.java?rev=1592&r1=1591&r2=1592&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/SignatureValidationFilter.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/saml2/metadata/provider/SignatureValidationFilter.java Fri Sep 28 19:32:34 2012
@@ -17,6 +17,7 @@
 
 package org.opensaml.saml2.metadata.provider;
 
+import java.util.HashSet;
 import java.util.Iterator;
 
 import org.opensaml.saml2.metadata.AffiliationDescriptor;
@@ -195,6 +196,8 @@
                 log.error("RoleDescriptor '{}' subordinate to entity '{}' failed signature verification, " 
                        + "removing from metadata provider", 
                        roleChild.getElementQName(), entityID); 
+                // Note that this is ok since we're iterating over an IndexedXMLObjectChildrenList directly,
+                // rather than a sublist like in processEntityGroup, and iterator remove() is supported there.
                roleIter.remove();
             }
         }
@@ -237,6 +240,10 @@
             verifySignature(entitiesDescriptor, entitiesDescriptor.getName(), true);
         }
         
+        // Can't use IndexedXMLObjectChildrenList sublist iterator remove() to remove members,
+        // so just note them in a set and then remove after iteration has completed.
+        HashSet<XMLObject> toRemove = new HashSet<XMLObject>();
+        
         Iterator<EntityDescriptor> entityIter = entitiesDescriptor.getEntityDescriptors().iterator();
         while (entityIter.hasNext()) {
             EntityDescriptor entityChild = entityIter.next();
@@ -253,8 +260,13 @@
             } catch (FilterException e) {
                log.error("EntityDescriptor '{}' failed signature verification, removing from metadata provider", 
                        entityChild.getEntityID()); 
-               entityIter.remove();
-            }
+               toRemove.add(entityChild);
+            }
+        }
+        
+        if (!toRemove.isEmpty()) {
+            entitiesDescriptor.getEntityDescriptors().removeAll(toRemove);
+            toRemove.clear();
         }
         
         Iterator<EntitiesDescriptor> entitiesIter = entitiesDescriptor.getEntitiesDescriptors().iterator();
@@ -266,10 +278,13 @@
             } catch (FilterException e) {
                log.error("EntitiesDescriptor '{}' failed signature verification, removing from metadata provider", 
                        entitiesChild.getName()); 
-               entitiesIter.remove();
-            }
-        }
-        
+               toRemove.add(entitiesChild);
+            }
+        }
+        
+        if (!toRemove.isEmpty()) {
+            entitiesDescriptor.getEntitiesDescriptors().removeAll(toRemove);
+        }
     }
 
     /**