[
https://issues.apache.org/jira/browse/KNOX-1230?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16419587#comment-16419587
]
Phil Zampino commented on KNOX-1230:
------------------------------------
* In DefaultCryptoService#decryptForCluster(), there is a check for a null
result from getEncryptor(), but it never returns nulll; It doesn't appear that
it has changed functionally.
* In DefaultKeystoreService, I think the keyStore file handling (in multiple
methods) can safely be done outside the locks...critical sections are best kept
as narrowly-focused as possible.
* Also in DefaultKeystoreService, it might be helpful to comment about the fact
that those methods affecting the state of the cache member are only safe if
invoked as they currently are, within guarded critical sections.
* In GatewayDispatchFilter, the lock member should be final to serve as a
synchronization object
> Many Concurrent Requests to Knox causes URL Mangling
> ----------------------------------------------------
>
> Key: KNOX-1230
> URL: https://issues.apache.org/jira/browse/KNOX-1230
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Larry McCay
> Assignee: Larry McCay
> Priority: Major
> Fix For: 1.1.0
>
> Attachments: KNOX-1230-001.patch, KNOX-1230-002.patch, test-upload.sh
>
>
> We have had some thread safety issues in both our crypto and dispatch
> machinery for what appears to be have been a long time - if not forever.
> This patch locks down access to the DefaultKeystoreService, synchronizes the
> creation and initialization of dispatches and removes most of the state in
> the ConfigurableEncryptor class. It also moves the responsibility of query
> string encryption and decryption into the
> SecureQueryEncrypt/DecryptProcessors themselves rather than leveraging the
> CryptoService by creating member variables for the required
> ConfigurableEncryptor.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
