Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-138

AbstractRememberMeManager attempts to process null/empty byte array

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.0.0
    • Fix Version/s: 1.0.0
    • Component/s: Web
    • Labels:
      None

      Description

      AbstractRememberMeManager#getRememberedPrincipals will call the 'convertBytesToPrincipals' method even if the 'getRememberedSerializedIdentity' method call returns a null/empty byte array, resulting in the following stack trace. The 'convertBytesToPrincipals' method should only be called with a non null/empty byte array.

      21419 [btpool0-1] WARN org.apache.shiro.mgt.DefaultSecurityManager -
      Delegate RememberMeManager instance of type
      [org.apache.shiro.web.WebRememberMeManager] threw an exception during
      getRememberedPrincipals().
      java.lang.IllegalStateException: Unable to crypt bytes with cipher
      [javax.crypto.Cipher@1b951f2].
      at
      org.apache.shiro.crypto.BlowfishCipher.crypt(BlowfishCipher.java:196)
      at
      org.apache.shiro.crypto.BlowfishCipher.crypt(BlowfishCipher.java:221)
      at
      org.apache.shiro.crypto.BlowfishCipher.decrypt(BlowfishCipher.java:143)
      at
      org.apache.shiro.mgt.AbstractRememberMeManager.decrypt(AbstractRememberMeManager.java:571)
      at
      org.apache.shiro.mgt.AbstractRememberMeManager.convertBytesToPrincipals(AbstractRememberMeManager.java:512)
      at
      org.apache.shiro.mgt.AbstractRememberMeManager.getRememberedPrincipals(AbstractRememberMeManager.java:482)
      at
      org.apache.shiro.mgt.DefaultSecurityManager.getRememberedIdentity(DefaultSecurityManager.java:586)
      at
      org.apache.shiro.mgt.DefaultSecurityManager.resolvePrincipals(DefaultSecurityManager.java:475)
      at
      org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:352)
      at
      org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:751)
      at
      org.apache.shiro.web.subject.WebSubject$Builder.buildWebSubject(WebSubject.java:95)
      at
      org.apache.shiro.web.servlet.AbstractShiroFilter.bind(AbstractShiroFilter.java:215)
      at
      org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:302)
      at
      org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:81)
      at
      org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
      at
      com.google.appengine.api.blobstore.dev.ServeBlobFilter.doFilter(ServeBlobFilter.java:51)
      at
      org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
      at
      com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43)
      at
      org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
      at
      com.google.appengine.tools.development.StaticFileFilter.doFilter(StaticFileFilter.java:121)
      at
      org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
      at
      org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
      at
      org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
      at
      org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
      at
      org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:712)
      at
      org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
      at
      com.google.apphosting.utils.jetty.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:70)
      at
      org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
      at
      com.google.appengine.tools.development.JettyContainerService$ApiProxyHandler.handle(JettyContainerService.java:352)
      at
      org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
      at org.mortbay.jetty.Server.handle(Server.java:313)
      at
      org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:506)
      at
      org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:830)
      at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:514)
      at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
      at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:381)
      at
      org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:396)
      at
      org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:442)
      Caused by: java.lang.IllegalArgumentException: Null input buffer
      at javax.crypto.Cipher.doFinal(DashoA13*..)
      at
      org.apache.shiro.crypto.BlowfishCipher.crypt(BlowfishCipher.java:193)
      ... 37 more

        Attachments

          Activity

            People

            • Assignee:
              lhazlewood Les Hazlewood
              Reporter:
              lhazlewood Les Hazlewood
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - 5m
                5m
                Remaining:
                Remaining Estimate - 5m
                5m
                Logged:
                Time Spent - Not Specified
                Not Specified