> This fix improves the exception message to better indicate when the key (and > not the signature algorithm) is restricted. This change also includes a few > other improvements: > > - The constraints checking in `AlgorithmChecker.check()` has been improved. > If the `AlgorithmConstraints` are an instance of > `DisabledAlgorithmConstraints`, the internal `permits` methods are always > called; otherwise the public `permits` methods are called. This makes the > code easier to understand, and fixes at least one case where duplicate checks > were being done. > > - The above change caused some of the exception messages to be slightly > different, so some tests that checked the error messages had to be updated to > reflect that. > > - AlgorithmDecomposer now stores the decomposed SHA algorithm names in a Map, > which fixed a bug where "RSASSA-PSS" was not being restricted properly.
Sean Mullan has updated the pull request incrementally with one additional commit since the last revision: - Skip digest alg decomposing check for algorithms that don't contain "SHA". - Remove hasLoop method and fold code into decomposeName method. ------------- Changes: - all: https://git.openjdk.java.net/jdk/pull/5928/files - new: https://git.openjdk.java.net/jdk/pull/5928/files/cf5a4d7f..f2031126 Webrevs: - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=5928&range=02 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=5928&range=01-02 Stats: 27 lines in 1 file changed: 15 ins; 10 del; 2 mod Patch: https://git.openjdk.java.net/jdk/pull/5928.diff Fetch: git fetch https://git.openjdk.java.net/jdk pull/5928/head:pull/5928 PR: https://git.openjdk.java.net/jdk/pull/5928
