[
https://issues.apache.org/jira/browse/JCR-5260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Julian Reschke updated JCR-5260:
--------------------------------
Affects Version/s: 2.23.5
2.22.4
2.20.17
> Uncaught non-RepositoryException types in HTTP responses break JCR clients
> --------------------------------------------------------------------------
>
> Key: JCR-5260
> URL: https://issues.apache.org/jira/browse/JCR-5260
> Project: Jackrabbit Content Repository
> Issue Type: Bug
> Components: jackrabbit-jcr2dav
> Affects Versions: 2.20.17, 2.22.4, 2.23.5
> Reporter: Julian Reschke
> Assignee: Julian Reschke
> Priority: Critical
> Fix For: 2.20.18, 2.23.6, 2.22.5
>
>
> The WebDAV remoting layer currently marshals arbitrary Java exceptions into
> HTTP response payloads instead of restricting them strictly to
> javax.jcr.RepositoryException and its subclasses.
> Why this breaks clients expecting javax.jcr.RepositoryException:
> Clients only have JCR and Jackrabbit client JARs on their classpath. If the
> server serializes a server-only exception, client deserialization fails with
> ClassNotFoundException, hiding the real cause.
> Client code expects to catch javax.jcr.RepositoryException. Unmapped runtime
> exceptions bypass these catch blocks and cause unexpected application crashes.
> Serializing arbitrary exceptions exposes internal server stack traces and
> dependency details over the wire.
> Client compatibility becomes tied to the server's internal classpath and
> library dependencies.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
