DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUGĀ·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40512>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED ANDĀ·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=40512

           Summary: Fix incompatible API changes to TransformSpi
           Product: Security
           Version: unspecified
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: regression
          Priority: P2
         Component: Signature
        AssignedTo: security-dev@xml.apache.org
        ReportedBy: [EMAIL PROTECTED]


In 1.4, a new abstract protected
enginePerformTransform(XMLSignatureInput, Transform) method was added to the
TransformSpi class and the existing enginePerformTransform(XMLSignatureInput)
method was
removed. The new method was designed to replace the old method and was
done to improve performance, which is all very good.

Unfortunately, it means that existing TransformSpi implementations when
compiled against 1.4 will not compile until the new method is
implemented. This is not a problem for the built-in implementations with
XMLSec (since they have been adjusted) but it is a problem for any
TransformSpi implementations developed by users out there. In any case,
this particular compilation failure is not such a big deal since you
will want to implement the better method anyway.

The more serious problem (IMO) is that you will get a runtime error
(NoSuchMethodError) if the current TransformSpi implementations are run
with 1.4 without updating and recompiling to support the new method
(because the new methods don't exist). So this means you cannot
seamlessly upgrade existing TransformSpi implementations to 1.4 without
reimplementing the new methods. 

Suggested fix (for TransformSpi):

1. Restore old method
2. Change new method to be non-abstract and throw UnsupportedOperationExc 
by default
3. Change Transform code to fallback to old method if it gets UnsuppOpExc, ex:

try {
  result = transformSpi.enginePerformTransform(input,this);
} catch (UnsupportedOperationException ex) {
  result = transformSpi.enginePerformTransform(input);

4. Document in release notes that developers should override new method

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Reply via email to