[java-plugin-storage-jdbc] branch main updated: JJDBC-33 Enforce limits on context and key size

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-storage-jdbc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-storage-jdbc/commit/157a93360c6ecbc8a5c413a4347142dc38599bfe

The following commit(s) were added to refs/heads/main by this push:
     new 157a933  JJDBC-33 Enforce limits on context and key size
157a933 is described below

commit 157a93360c6ecbc8a5c413a4347142dc38599bfe
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Jul 14 15:27:24 2026 +0100

    JJDBC-33 Enforce limits on context and key size
    
    https://shibboleth.atlassian.net/browse/JJDBC-33
    
    It turns out that we do NOT have to worry about databases turning
    things into UTFS and then having that size the VARCHAR size.
    
    All modern databases use "character points".
    
    remove the UTF-8 encoding before checking context and key size
---
 .../plugin/storage/jdbc/impl/JDBCStorageService.java       | 14 ++++----------
 .../plugin/storage/jdbc/impl/JDBCStorageServiceTest.java   |  9 +++------
 2 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java b/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
index 278e678..a491503 100644
--- a/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
+++ b/jdbc-storage-impl/src/main/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageService.java
@@ -16,7 +16,6 @@
 package net.shibboleth.plugin.storage.jdbc.impl;
 
 import java.io.IOException;
-import java.nio.charset.Charset;
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
@@ -128,9 +127,6 @@ public final class JDBCStorageService extends AbstractStorageService
     /** Default timeout of SQL queries. */
     @Nonnull static final Duration DEFAULT_QUERY_TIMEOUT = Duration.ofSeconds(5);
 
-    /** Charset to use when calculating the "on disk" size of the key and context. */
-    @Nonnull static final Charset ENCODING_CHARSET = Charset.forName("UTF8");
-
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(JDBCStorageService.class);
     
@@ -480,16 +476,14 @@ public final class JDBCStorageService extends AbstractStorageService
      */
     private void checkContextAndKeySize(@Nonnull final String context, @Nullable String key) throws IOException
     {
-        int size = context.getBytes(ENCODING_CHARSET).length;
-        if (size > getContextSize()) {
-            log.error("Context {} was too large ({{} > {})", context, size, getContextSize());
+        if (context.length() > getContextSize()) {
+            log.error("Context {} was too large ({{} > {})", context, context.length(), getContextSize());
             throw new IOException("Supplied Context was too large");
         }
 
         if (key != null) {
-            size = key.getBytes(ENCODING_CHARSET).length;
-            if (size > getKeySize()) {
-                log.error("Key {} was too large ({{} > {})", key, size, getKeySize());
+            if (key.length() > getKeySize()) {
+                log.error("Key {} was too large ({{} > {})", key, key.length(), getKeySize());
                 throw new IOException("Supplied Key was too large");
             }
         }
diff --git a/jdbc-storage-impl/src/test/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageServiceTest.java b/jdbc-storage-impl/src/test/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageServiceTest.java
index c2c2a53..353c6e4 100644
--- a/jdbc-storage-impl/src/test/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageServiceTest.java
+++ b/jdbc-storage-impl/src/test/java/net/shibboleth/plugin/storage/jdbc/impl/JDBCStorageServiceTest.java
@@ -20,7 +20,6 @@ import static org.testng.Assert.assertTrue;
 import static org.testng.Assert.fail;
 
 import java.io.IOException;
-import java.nio.charset.Charset;
 import java.security.SecureRandom;
 import java.sql.Connection;
 import java.sql.SQLException;
@@ -369,14 +368,12 @@ public class JDBCStorageServiceTest extends StorageServiceTest {
     public void veryLongContextAndKey() {
 
         final StringBuilder builder = new StringBuilder();
-        Character foo = '\u1000';
 
-        for (int i = 0; i < 180; i++) {
-            builder.append(foo++);
+        for (int i = 0; i < 30; i++) {
+            builder.append("0123456789");
         }
         final String longString = builder.toString();
-        assertTrue(longString.length() < 255);
-        assertTrue(longString.getBytes(Charset.forName("UTF8")).length > 255);
+        assertTrue(longString.length() > 255);
 
         final Long then = System.currentTimeMillis() + 300000;
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.