JDK-7195301 : XML Signature DOM implementation should not use instanceof to determine type of Node
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.xml.crypto
  • Affected Version: 6
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2012-08-30
  • Updated: 2013-09-12
  • Resolved: 2012-09-25
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 JDK 8
6u37Fixed 7u40Fixed 8 b58Fixed
Description
The XML Signature DOM implementation should not use instanceof to determine type of Node. This is not guaranteed to behave consistently on all DOM implementations. Instead we should always use Node.getNodeType() to determine the type of Node. 

More details to be added later.
Comments
Verified changes with manual code review. Verified the fix with attached test. Fix verified with b58 and b100.
27-08-2013
SUGGESTED FIX Changeset: a51f86e2dce9 Author: mullan Date: 2012-09-10 08:57 -0400 URL: http://hg.openjdk.java.net/jdk8/tl/jdk/rev/a51f86e2dce9 7195301: XML Signature DOM implementation should not use instanceof to determine type of Node Reviewed-by: xuelei ! src/share/classes/com/sun/org/apache/xml/internal/security/Init.java ! src/share/classes/com/sun/org/apache/xml/internal/security/c14n/implementations/CanonicalizerBase.java ! src/share/classes/com/sun/org/apache/xml/internal/security/encryption/XMLCipher.java ! src/share/classes/com/sun/org/apache/xml/internal/security/keys/keyresolver/implementations/RetrievalMethodResolver.java ! src/share/classes/com/sun/org/apache/xml/internal/security/utils/IdResolver.java
10-09-2012
EVALUATION There are a handful of places in the XML Signature implementation that use instanceof instead of Node.getNodeType(). These will all be modified to use Node.getNodeType(). Need to be also careful to check for null references before calling Node.getNodeType() to avoid NullPointerExceptions.
07-09-2012