'Misuse' of Resource#getFile()

[Rod Widdowson]

Case IDP-893 made provoked me to do an analysis of places where we grab the
File from a (Spring) resource.  As Misagh points out in the case notes this
means that http: resources cannot be used and although this might be a silly
thing,  it is also gratuitous.

The case refers to one situation in which the called utility function (in
Cryptacular) can take a File or an InputStream so that is an easy fix.  But
it turns out that there are three other places where we using sending a File
where there is no support for InputStream

net.shibboleth.utilities.java.support.scripting.EvaluableScript :
	constructors take a File or a String

org.opensaml.security.crypto.KeySupport
	decodePrivateKey takes a File or a byte[]

org.opensaml.security.x509.X509Support
	decodeCertificates takes  File or a byte[]
	decodeCRLs takes a File or a byte[]

Obviously these can be fixed topically in the IdP by calling either
ByteStreams.toByteArray() or some equivalent for the String case.  But this
mail is to ask whether we think it is worth extending the above three
classes to take InputStreams?

As a secondary question should these functions close their InputStream – a
common paradigm appears to be that they should not, but I’d take guidance.

Rod