[java-support] branch master updated: JSPT-64: DataSealer can't handle reasonable data sizes

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-support.

The following commit(s) were added to refs/heads/master by this push:
       new  d83c707   JSPT-64: DataSealer can't handle reasonable data sizes
d83c707 is described below

commit d83c7072aa02e8c7962bb3cada0d98fe8f2ea2dd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 15 14:44:57 2016 -0500

    JSPT-64: DataSealer can't handle reasonable data sizes
    
    https://issues.shibboleth.net/jira/browse/JSPT-64
    
    Write data in 60,000 byte chunks consecutively, and read
    them back until EOFException is raised.
---
 .../java/support/security/DataSealer.java          | 35 ++++++++++++++++++----
 .../java/support/security/DataSealerTest.java      |  2 +-
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
index 81d2b63..b206362 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
@@ -21,6 +21,7 @@ import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.DataInputStream;
 import java.io.DataOutputStream;
+import java.io.EOFException;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.security.KeyException;
@@ -57,6 +58,9 @@ import org.slf4j.LoggerFactory;
  */
 public class DataSealer extends AbstractInitializableComponent {
 
+    /** Size of UTF-8 data chunks to read/write. */
+    private static final int CHUNK_SIZE = 60000;
+    
     /** Class logger. */
     @Nonnull private Logger log = LoggerFactory.getLogger(DataSealer.class);
 
@@ -210,15 +214,26 @@ public class DataSealer extends AbstractInitializableComponent {
             DataInputStream dataInputStream = new DataInputStream(compressedData);
 
             final long decodedExpirationTime = dataInputStream.readLong();
-            final String decodedData = dataInputStream.readUTF();
-
             if (System.currentTimeMillis() > decodedExpirationTime) {
-                log.info("Unwrapped data has expired");
+                log.debug("Unwrapped data has expired");
                 throw new DataExpiredException("Unwrapped data has expired");
             }
 
-            log.debug("Unwrapped data verified");
-            return decodedData;
+            final StringBuffer accumulator = new StringBuffer();
+            
+            int count = 0;
+            while (true) {
+                try {
+                    final String decodedData = dataInputStream.readUTF();
+                    accumulator.append(decodedData);
+                    log.trace("Read chunk #{} from output stream", ++count);
+                } catch (final EOFException e) {
+                    break;
+                }
+            }
+
+            log.trace("Unwrapped data verified");
+            return accumulator.toString();
         } catch (IOException e) {
             log.error(e.getMessage());
             throw new DataSealerException("Caught IOException unwrapping data", e);
@@ -265,7 +280,15 @@ public class DataSealer extends AbstractInitializableComponent {
             final DataOutputStream dataStream = new DataOutputStream(compressedStream);
 
             dataStream.writeLong(exp);
-            dataStream.writeUTF(data);
+            
+            int count = 0;
+            int start = 0;
+            int dataLength = data.length();
+            while (start < dataLength) {
+                dataStream.writeUTF(data.substring(start, start + Math.min(dataLength - start, CHUNK_SIZE)));
+                start += Math.min(dataLength - start, CHUNK_SIZE);
+                log.trace("Wrote chunk #{} to output stream", ++count);
+            }
 
             dataStream.flush();
             compressedStream.flush();
diff --git a/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java b/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
index a7d9215..1f6ec15 100644
--- a/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
+++ b/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
@@ -132,7 +132,7 @@ public class DataSealerTest {
         }
     }
 
-    public void encodeDecodeLong() throws DataSealerException, ComponentInitializationException {
+    @Test public void encodeDecodeLong() throws DataSealerException, ComponentInitializationException {
         final DataSealer sealer = createDataSealer();
         
         char[] buffer = new char[1000000];

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.