[java-plugin-storage-jdbc] branch main updated: JJDBC-33 Enforce limits on context and key size

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-storage-jdbc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-storage-jdbc/commit/a0adaec8e30a289fd4c95157a3ef1d4d72f476cf

The following commit(s) were added to refs/heads/main by this push:
     new a0adaec  JJDBC-33 Enforce limits on context and key size
a0adaec is described below

commit a0adaec8e30a289fd4c95157a3ef1d4d72f476cf
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Jul 12 16:18:40 2026 +0100

    JJDBC-33 Enforce limits on context and key size
    
    https://shibboleth.atlassian.net/browse/JJDBC-33
    
    Force the use of  UTF-8 when checking the key and context "on disk"
    lengths.
---
 .../shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java   | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java b/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
index e18ca5a..278e678 100644
--- a/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
+++ b/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
@@ -16,6 +16,7 @@
 package net.shibboleth.plugin.storage.jdbc.impl;
 
 import java.io.IOException;
+import java.nio.charset.Charset;
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
@@ -127,6 +128,9 @@ public final class JDBCStorageService extends AbstractStorageService
     /** Default timeout of SQL queries. */
     @Nonnull static final Duration DEFAULT_QUERY_TIMEOUT = Duration.ofSeconds(5);
 
+    /** Charset to use when calculating the "on disk" size of the key and context. */
+    @Nonnull static final Charset ENCODING_CHARSET = Charset.forName("UTF8");
+
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(JDBCStorageService.class);
     
@@ -476,14 +480,14 @@ public final class JDBCStorageService extends AbstractStorageService
      */
     private void checkContextAndKeySize(@Nonnull final String context, @Nullable String key) throws IOException
     {
-        int size = context.getBytes().length;
+        int size = context.getBytes(ENCODING_CHARSET).length;
         if (size > getContextSize()) {
             log.error("Context {} was too large ({{} > {})", context, size, getContextSize());
             throw new IOException("Supplied Context was too large");
         }
 
         if (key != null) {
-            size = key.getBytes().length;
+            size = key.getBytes(ENCODING_CHARSET).length;
             if (size > getKeySize()) {
                 log.error("Key {} was too large ({{} > {})", key, size, getKeySize());
                 throw new IOException("Supplied Key was too large");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.